AgentSign

Zero Trust Identity & Signing for AI Agents

Website | How It Works | Self-Host Server | npm

---

Every AI agent gets a cryptographic passport. Every execution is signed. Every MCP tool call is verified. No verification, no trust.

AgentSign is the identity and trust layer for autonomous AI agents. While tools like SSL verify who is connecting, AgentSign verifies who the agent is + what it did + proof it wasn't tampered with + its trust history.

Zero runtime dependencies. Node >= 18. Patent Pending.

Why AgentSign?

AI agents are now autonomous -- they make API calls, access databases, execute code, and spend money. But there's no standard way to:

• Verify an agent's identity before granting tool access
• Prove what an agent did with cryptographic evidence
• Revoke a compromised agent (or an entire swarm) instantly
• Score trust based on actual behavior, not just permissions
• Verify agent integrity offline -- no server dependency

AgentSign solves all five. On-prem. Your keys. Your infrastructure.

Install

npm install agentsign

Quick Start (5 lines)

const AgentSign = require('agentsign');

const agent = new AgentSign({ serverUrl: 'https://agentsign.internal:8888' });

// 1. Register -- agent enters identity pipeline
const { agent_id } = await agent.register({ name: 'Procurement Bot', category: 'finance' });

// 2. Advance through pipeline (INTAKE -> VETTING -> TESTING -> ACTIVE)
await agent.advanceToActive();

// 3. Get self-verifying passport (works offline)
const passport = await agent.getPassport();
// -> { agent_id, name, code_hash, trust_score: 85, pipeline_stage: 'ACTIVE', signature, ... }

// 4. Present passport to MCP server before using tools
const gate = await agent.verifyMCP('database-mcp', 'query_users');
// -> { decision: 'ALLOW', trust_score: 85, checks_passed: ['identity', 'trust', 'pipeline'] }

// 5. Sign every execution (cryptographic proof)
const signed = agent.sign({ query: 'SELECT * FROM users' }, { rows: 142 });
agent.verify(signed); // -> true (tamper-proof)

How It Works

                    +------------------+
                    |   AgentSign      |
                    |   Engine (8888)  |
                    +--------+---------+
                             |
              +--------------+--------------+
              |              |              |
        +-----v-----+  +----v----+  +------v------+
        | Identity   |  | Trust   |  | Execution   |
        | Pipeline   |  | Scoring |  | Ledger      |
        +-----+------+  +----+----+  +------+------+
              |              |              |
    INTAKE -> VETTING -> TESTING -> ACTIVE  |
              |              |              |
        +-----v-----+  +----v----+  +------v------+
        | Agent      |  | MCP     |  | Swarm       |
        | Passport   |  | Trust   |  | Management  |
        | (offline)  |  | Layer   |  | (revoke all)|
        +------------+  +---------+  +-------------+

The Five Subsystems

#	Subsystem	What It Does
1	Identity Pipeline	Agents go through INTAKE -> VETTING -> TESTING -> ACTIVE. Each gate is cryptographically recorded.
2	Agent Passport	Self-contained signed JSON. Agent carries it everywhere. Any system can verify offline.
3	Execution Chains	Every input/output pair is signed. Creates a tamper-proof DAG of what the agent did.
4	MCP Trust Layer	MCP servers call /api/mcp/verify before granting tool access. Identity + trust + policy check.
5	Trust Scoring	0-100 score based on code attestation, execution history, success rate, pipeline stage.

MCP Trust Layer

The killer feature. Every MCP tool call goes through identity verification:

// MCP server middleware (server-side)
app.post('/tools/query', async (req, res) => {
  // Agent presents passport, AgentSign decides ALLOW or DENY
  const gate = await fetch('http://agentsign:8888/api/mcp/verify', {
    method: 'POST',
    body: JSON.stringify({
      agent_id: req.headers['x-agent-id'],
      passport: req.headers['x-agent-passport'],
      mcp_server_id: 'database-mcp',
      tool_name: 'query'
    })
  });
  const { decision } = await gate.json();
  if (decision !== 'ALLOW') return res.status(403).json({ error: 'Trust gate denied' });
  // ... execute tool
});

Local Signing (Zero Network)

Sign and verify locally. No server calls. No network dependency.

const signed = agent.sign(
  { invoice: 'INV-001', amount: 350 },           // input
  { status: 'paid', txId: 'tx_abc123' }           // output
);
// -> { executionId, executionHash, signature, method: 'hmac', verified: true }

agent.verify(signed);                              // -> true
agent.verifyOutput({ status: 'paid', txId: 'tx_abc123' }, signed); // -> 'PASS'

HSM & Cloud KMS Support

Default signer is file-based (keyed hashing, keys at ~/.agentsign/keys/). For hardware security:

Signer	Install	Use Case
File (default)	--	Dev, testing, small deployments
PKCS#11	npm i pkcs11js	Thales, SafeNet, YubiHSM, SoftHSM
AWS KMS	npm i @aws-sdk/client-kms	AWS / CloudHSM
Azure Key Vault	npm i @azure/keyvault-keys @azure/identity	Azure
GCP Cloud KMS	npm i @google-cloud/kms	Google Cloud
HashiCorp Vault	-- (native fetch)	Vault Transit engine

// Example: AWS KMS
const agent = new AgentSign({
  serverUrl: 'http://localhost:8888',
  signer: 'aws-kms',
  aws: { keyId: 'arn:aws:kms:eu-west-2:123:key/abc-def', region: 'eu-west-2' },
});
const signed = await agent.signAsync(input, output);

Self-Host the Engine

# Docker (recommended)
docker run -d -p 8888:8888 -v agentsign-data:/app/data ghcr.io/razashariff/agentsign:latest

# Or Helm (Kubernetes)
helm install agentsign ./deploy/helm/agentsign \
  --set signer=aws-kms \
  --set aws.keyId=arn:aws:kms:eu-west-2:123:key/abc

Server repo: github.com/razashariff/agentsign

API Reference

Method	Description
register({ name, category })	Register agent, enters INTAKE pipeline stage
advance()	Advance one pipeline stage
advanceToActive()	Auto-advance to ACTIVE
getPassport()	Get self-verifying passport (works offline)
getAgent()	Get agent details + trust score
revoke(reason)	Instant revocation
verifyMCP(mcpId, tool)	Present passport to MCP Trust Gate
sign(input, output)	Local cryptographic signing
verify(execution)	Verify signed execution
verifyOutput(output, exec)	Check output integrity
pay(to, pence, desc)	Trust Gate payment (identity + policy + Stripe)
freeze() / unfreeze()	Freeze/unfreeze agent wallet

Pipeline Stages

INTAKE --> VETTING --> TESTING --> DEV_APPROVED --> PROD_APPROVED --> ACTIVE
                                                                       |
                                                                   REVOKED

Comparison

	AgentSign	API Keys	OAuth	mTLS
Agent identity	Cryptographic passport	Shared secret	Token (human-centric)	Cert (connection only)
What agent did	Signed execution chain	Nothing	Nothing	Nothing
Tamper detection	Cryptographic hash chain	None	None	None
Trust scoring	0-100 behavioral	None	Scopes (static)	None
Offline verification	Yes (passport)	No	No	Partial
Swarm revocation	Instant (all agents)	Manual	Manual	CRL lag
MCP integration	Native Trust Gate	None	None	None

Contributing

PRs welcome. See CONTRIBUTING.md.

License

MIT. Patent Pending.

Built by CyberSecAI. Website: agentsign.dev.