# Agent Passport [Health: Active]

**Category:** 🔑 Cryptography  
**Repository:** https://github.com/johnInarti/agent-passport-mcp  
**GitHub Stars:** 0  
**npm Downloads (last month):** 629  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/agent-passport-3

## Description
Post-quantum (ML-DSA-65/FIPS-204) agent identity + AI-decision receipts, verifiable offline.

## Tools
Capabilities this server exposes over MCP:

- **verify_passport** — Free. Independently verify a verifiable agent passport / attestation. Give it an attestation permalink (https://fractalai.net.co/attestation/0x…) or the bare 0x hash — optionally plus the receipt JSON you were handed at issue time (if it carries an `ml_dsa65` field). It: (1) fetches the public attestation record, (2) [independent] recomputes sha256(input)/sha256(output) and reconstructs the exact canonical signed message, (3) [independent] verifies the ML-DSA-65 (NIST FIPS 204) signature 100% OFFLINE with @noble/post-quantum against a key PINNED IN SOURCE (the FractalAI receipt key — NEVER the key quoted in the receipt), (4) [server-assisted] verifies the Dilithium-2 signature over the canonical bytes plus a tamper negative-control, and (5) reads the agent's on-chain FRC-55 state (fractal_getAgent) when agent_id is an on-chain id. Returns { valid_independent, valid_server_assisted, valid, algorithm, checks[], anchored, decision, agent }. TRUST: rely on `valid_independent` — it is true ONLY when an ML-DSA-65 signature verifies against the pinned key (fail-closed: no/empty signature ⇒ false). `valid_server_assisted` trusts the FractalAI server. `valid` aliases the conservative independent verdict. HONEST SCOPE: a pass means the signature is intact over the exact bytes and the record is internally consistent and anchored on FractalAI's L1 — it does NOT prove the assertion is true or that the agent's decision was correct.
- **issue_passport** — Issue a verifiable agent passport = an agent id + a SIGNED assertion + a re-verifiable permalink. It (a) resolves the agent on the FRC-55 registry when agent_id is an on-chain id (fractal_getAgent), and (b) seals the assertion through the REAL x402 (HTTP 402) attest-decision flow: the assertion is Dilithium-2 signed, Black-Box chained and anchored on FractalAI's L1, returning a receipt anyone can re-check with verify_passport. WHAT IT PROVES: this exact assertion was attested by (and bound to) this agent id, is cryptographically intact, and is anchored on-chain. WHAT IT DOES NOT PROVE: that the assertion is TRUE, that the agent's decision was CORRECT, or any decentralized/consensus-scored reputation — it does NOT register reputation. PAYMENT: this is a paid x402 resource ($0.05 USDC on Base). Call once WITHOUT payment_tx_hash to get the exact payment challenge (accepts[]: amount, USDC asset, payTo); pay that USDC yourself; then call again WITH payment_tx_hash set to the confirmed transaction hash. Without payment it returns the challenge — it never fabricates a passport.
- **lookup_agent** — Free. Read an agent's PUBLIC state from the FRC-55 registry on the live FractalAI L1 node (fractal_getAgent) — name, owner, status, model, price_per_call, total_calls, rating, total_ratings, created_at — for reputation/status checks. Omit agent_id to list all registered agents (fractal_listAgents). Always returns registry-wide stats (fractal_getAgentStats). This is on-chain registry data as reported by the node; ratings are the registry's own counters, not an independent audit.
- **list_fractalai_proofs** — Free. Return the live catalog of FractalAI's x402 post-quantum proof services (price, algorithm, endpoint, and what each proves) read straight from the canonical /.well-known/x402.json. Call this first to discover every proof you can buy: signatures, AI-decision notarization, dataset/training provenance, CBOM sealing, Know-Your-Agent, and signature verification.
- **witness_payment** — Obtain a FractalAI ML-DSA-65 attestation of a declared payment settlement. The service checks the claimed transfer when a transaction is supplied. Call without payment first for the current price and requirements. Keep the exact request and payment authorization for recovery; this tool never retries payments. Use the witness SDK to construct request_binding for bound requests. An attestation does not prove the purchased content is true.
- **seal_ml_dsa** — Get a post-quantum ML-DSA-65 / Dilithium-3 (NIST FIPS 204) signature over any message or hash — signed locally, verifiable OFFLINE, with a verifiable on-chain-anchored receipt. Call when your agent needs a durable, quantum-safe signature or proof of authenticity. Price $0.02 USDC on Base.
- **notarize_decision** — Notarize an AI decision: bind (input, output, model) into a post-quantum-signed, Black-Box-chained, on-chain-anchored attestation with a re-verifiable permalink. Call to make an autonomous agent's decision auditable and non-repudiable (EU AI Act Art. 12 alignment). Proves the decision was sealed intact — NOT that it was correct. Price $0.05 USDC on Base.
- **prove_provenance** — Seal the provenance of a dataset / training run / AI-generated content: a post-quantum signature + a drand lower-bound timestamp (cannot be backdated) + an on-chain anchor. Call to prove PRIOR EXISTENCE and INTEGRITY of AI data your agent produced or consumed. Privacy-preserving (send a hash). Price $0.05 USDC on Base.
- **attest_training** — Attest how/what an AI model was trained: a post-quantum-signed C2PA-style provenance manifest over a dataset/training hash for a given model_id. Call to give a model a verifiable training-provenance record. Privacy-preserving (send dataset_hash). Price $0.05 USDC on Base.
- **seal_cbom** — Seal a CycloneDX CBOM (ECMA-424, cryptographic inventory) with a post-quantum signature + drand timestamp — a machine-readable PQC-readiness / crypto-posture disclosure (CNSA 2.0, procurement). Call to certify your declared cryptographic inventory. Price $0.05 USDC on Base.
- **verify_agent_kya** — Know-Your-Agent (KYA): verify another agent's FractalAI credential (post-quantum signature) and read its live FRC-55 on-chain reputation. Call BEFORE trusting, delegating to, or paying another agent. Returns a post-quantum-signed verdict. Price $0.03 USDC on Base.
- **verify_proof** — Verify a post-quantum signature over a message against a public key — auto-detects ML-DSA-65 / Dilithium-3 (verified offline) or Dilithium-2 (node). The floor primitive ($0.01) for any proof pipeline; returns a post-quantum-signed verdict receipt. Price $0.01 USDC on Base.
- **list_agents** — Free. Fetch /.well-known/agents.json — the ML-DSA-65-SIGNED index of agents whose latest fractalai-agent-manifest/1 is CURRENT (key equals the agent's current key on the FractalAI node, passport verifies, FRC-55 status Active, not expired) — and verify the index signature OFFLINE against the notary key PINNED in this package (never a key the server hands over). An index whose signature does not verify, that is expired (expires_at), or that is OLDER (issued_at/seq) than one already accepted in this process is returned as an ERROR with no agents. Returns { index_signature_verified: true, signer_kid, issued_at, expires_at, seq, scope, registry { identity_root, height }, agents[] { id, name, did, manifest_url, manifest_id, version, kid, status } }. Set include_all to also list non-current agents (rotated key, paused, expired) from /api/agents/registry?status=all with their reasons. Set region (ISO 3166-1 alpha-2, e.g. CO) to fetch the SEPARATELY signed regional index (?region=CO: only current agents whose manifest declares that country); the signed scope.region MUST equal the request — a global index re-served for a regional request is an ERROR index_scope_mismatch, never a fallback; a valid region with no agents is a signed empty list; an unlisted code is the server's 400 region_invalid. Prices are never listed: the binding price is each resource's live 402.
- **get_agent_manifest** — Free. Fetch /api/agents/registry/<id> (current manifest) or /api/agents/registry/<id>/v/<n> (immutable version), then verify it OFFLINE: manifest_id recomputed with JCS, ML-DSA-65 signature checked — against the manifest's embedded key ONLY if that key equals the agent's CURRENT key reported by the registry/node (…/passport), otherwise reported as key_not_current/rotated. Returns { manifest, ok, verdict (current|not_current), signature_ok, passport_valid, agent_active, registry_verification (key_status, agent_status, passport_valid), offline { ok, checks[] }, trust }. ok = signature_ok && passport_valid && agent_active; anything else is an error with not_ok_because[] (a Destroyed agent is never ok).
- **verify_agent_manifest** — Free. Verify a manifest JSON you were handed: JCS manifest_id recomputation + ML-DSA-65 signature (alg anchored; key 1952 B, signature 3309 B; nothing inferred from sizes) + lifetime. The verification key is (a) pubkey_b64url if you supply it (caller-trusted, fully offline), else (b) the agent's CURRENT key as the registry/node reports it, used only if it equals the manifest's embedded key (registry-assisted). The embedded key alone is never trusted. Returns three SEPARATE verdicts { signature_ok, passport_valid, agent_active } and ok = all three true with verdict "current"/"not_current" (with a caller-supplied key the registry is not consulted: verdict is "signature_only", ok is null when the signature verifies (never true) and false when it does not, passport_valid and agent_active are null — say so to the user). Plus { checks[], trust }.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "agent-passport": {
    "command": "npx",
    "args": ["-y","@fractalai/agent-passport-mcp"]
  }
}
```

## Documentation & README

# Agent Passport — MCP server

The **free** tool a developer drops in, in ~5 lines, to **issue** and **independently verify**
a *verifiable passport* for an AI agent — over the [Model Context Protocol](https://modelcontextprotocol.io),
so it works in **LangChain, CrewAI, AutoGen, OpenAI Agents, Claude Desktop** — anything that speaks MCP.

It talks to the **real, public FractalAI deployment**: the live L1 JSON-RPC node at
`https://api.fractalai.net.co` (FRC-55 agent registry) and the web endpoints at
`https://fractalai.net.co` (attestations, receipt key, x402). **Nothing here is mocked.**

```bash
npx @fractalai/agent-passport-mcp
```

## Tools

| Tool | Cost | What it REALLY does today |
|------|------|---------------------------|
| `verify_passport` | **free** | Given an attestation permalink / `0x` hash (and optionally the receipt JSON): recomputes the content hashes, reconstructs the exact canonical signed message, verifies the **ML-DSA-65 (NIST FIPS 204)** signature **100% offline** against the published `/api/x402/receipt-key`, verifies the **Dilithium-2** signature server-assisted with a tamper negative-control, and reads the agent's **FRC-55 on-chain** state. Returns `{ valid, algorithm, checks[], anchored, decision, agent }`. |
| `issue_passport` | **x402 ($0.05 USDC)** | Binds an `agent_id` + a **signed assertion** + a re-verifiable permalink: resolves the agent on the FRC-55 registry (if it's an on-chain id) and seals the assertion through the **real x402 attest-decision** flow (Dilithium-2 signed, Black-Box chained, anchored on the L1). Without a `payment_tx_hash` it returns the payment challenge — it never fabricates a passport. |
| `lookup_agent` | **free** | Public FRC-55 registry read on the live node: `fractal_getAgent` for one agent (name, owner, status, model, `total_calls`, `rating`, `total_ratings`, `created_at`) or `fractal_listAgents` for all, always with `fractal_getAgentStats`. |
| `list_fractalai_proofs` | **free** | Self-describing discovery: reads the canonical `/.well-known/x402.json` live and returns the full proof catalog (price, algorithm, endpoint, what each proves) — one call maps the whole x402 surface and auto-heals if it changes, since it reflects the live source of truth rather than a hardcoded copy. |
| `list_agents` | **free** | Fractal Agent Commons: fetches the **ML-DSA-65-signed** index of registered agents (`/.well-known/agents.json`, only agents whose latest manifest is *current*: key = the agent's current key on the node, passport verifies, FRC-55 Active, not expired) and verifies the index signature **offline against the notary key pinned in this package**. `include_all` adds non-current agents with their reasons. `region` (ISO 3166-1 alpha-2, e.g. `CO`) fetches the separately signed REGIONAL index (`?region=CO`) and requires its signed `scope.region` to equal the request — a global index re-served for a regional request is `index_scope_mismatch`, never a fallback. |
| `get_agent_manifest` | **free** | Fetches an agent's `fractalai-agent-manifest/1` (current, or an immutable `version`), recomputes `manifest_id` (JCS) and verifies the agent's ML-DSA-65 signature **only** with the key the registry/node reports as the agent's *current* key — never the manifest's embedded key alone. |
| `verify_agent_manifest` | **free** | Offline verification of a manifest JSON you were handed: `alg` anchored to ML-DSA-65 (1952-byte key / 3309-byte signature, nothing inferred from sizes), JCS `manifest_id`, lifetime ≤ 30 d. Verification key = `pubkey_b64url` you supply (fully offline), else the agent's current key from the registry/node, used only if it equals the embedded key. |

### x402-paid tools (v0.2.0) — post-quantum proofs, pay-per-call

The 8 supported FractalAI x402 routes are surfaced as **auto-payable** MCP tools. An x402-aware wallet client
signs an EIP-3009 authorization and pays in **USDC on Base** using the standard `_meta["x402/payment"]`
convention. Each **served** signature is **ML-DSA-65 / Dilithium-3 (NIST FIPS 204)** and verifiable
**offline**; each also **attempts** an on-chain anchor on FractalAI's L1 (the anchor signature is
Dilithium-2 / ML-DSA-44-class, pending the gated consensus cut-over — see "Honest scope"). Uses the
FIPS-204-standardized algorithm via audited `@noble/post-quantum` (not a FIPS-validated CMVP module).
Call any tool **without** payment first to get the exact price + payment challenge.

| Tool | Price | What it does |
|------|------|---------------|
| `seal_ml_dsa` | $0.02 | Post-quantum signature over any message/hash — durable, quantum-safe, offline-verifiable. |
| `verify_proof` | $0.01 | Verify a signature (auto-detects ML-DSA-65 or Dilithium-2). The floor primitive for any proof pipeline. |
| `verify_agent_kya` | $0.03 | Know-Your-Agent: verify another agent's credential + live FRC-55 reputation before you trust/pay it. |
| `notarize_decision` | $0.05 | Notarize an AI decision (input, output, model) → auditable, non-repudiable, on-chain (EU AI Act Art. 12). |
| `prove_provenance` | $0.05 | Provenance seal over a dataset/content hash + drand timestamp + on-chain anchor. |
| `attest_training` | $0.05 | C2PA training-provenance manifest for a model, post-quantum signed. |
| `seal_cbom` | $0.05 | Seal a CycloneDX CBOM (crypto inventory) — CNSA 2.0 / procurement PQC-readiness disclosure. |

Payment note: paid tools accept the standard `_meta["x402/payment"]` (auto-pay) and also a plain
`payment` string arg (base64 X-PAYMENT) as a universal fallback. Nothing is fabricated — the tools
proxy to the live routes and relay exactly what they return, honest scope included.

## Honest scope (read this — project Regla 4)

A **valid passport** proves an **identity + a specific attested assertion** are cryptographically
intact over the exact signed bytes, that the record is internally consistent, and that it is
**anchored on FractalAI's L1**. It does **NOT** prove:

- that the assertion is **true**, or that the agent's decision/action was **correct**;
- any **decentralized / consensus-scored reputation** — `issue_passport` does **not** register reputation;
- `lookup_agent` ratings are the **registry's own counters** as reported by the node, not an independent audit.

Signature checks are labeled by trust model: **`[independent]`** = computed locally, does not trust
the FractalAI server (the offline ML-DSA-65 check, content hashes); **`[server-assisted]`** = calls a
FractalAI endpoint (the Dilithium-2 `/api/proofmind/verify` check). The ML-DSA-65 verification uses the
FIPS-204-standardized algorithm via the audited `@noble/post-quantum` library — this is **not** a
FIPS-validated (CMVP) module.

### What is real **today** vs roadmap

- **Real today:** offline ML-DSA-65 verification against the published key; server-assisted Dilithium-2
  verification + tamper control; FRC-55 on-chain agent reads; the real x402 402→pay→seal flow for issuing.
- **Roadmap (not claimed as done):** server-issued attestations are currently self-signed by the server
  key and anchored on FractalAI's own L1; full on-chain consensus validation and a decentralized,
  consensus-scored reputation are future milestones. The `ml_dsa65` detached signature is delivered to
  pilot integrations today (pass it via the `receipt` argument) and is being rolled into the public API.

## Use it

You don't need to install or build anything — `npx` fetches and runs the published package
directly (see the config block above). No account, no API key.

## Contributing (building from source)

Only needed if you're working on the server itself, inside the FractalAI monorepo:

```bash
cd integrations/agent-passport-mcp
npm install
npm run build      # tsc → dist/
npm test           # handshake: server stands up, tools respond, ML-DSA-65 round-trips
```

## Configure in an MCP client

### Claude Desktop (`claude_desktop_config.json`)

```json
{
  "mcpServers": {
    "agent-passport": { "command": "npx", "args": ["-y", "@fractalai/agent-passport-mcp"] }
  }
}
```

### Environment

- `FRACTALAI_BASE_URL` — web endpoint base (default `https://fractalai.net.co`).
- `FRACTALAI_RPC_URL` — L1 JSON-RPC node (default `https://api.fractalai.net.co`).
- `AGENT_PASSPORT_AUTODEMO` — on connect, the server makes one real, free call to the live node
  (`fractal_getAgentStats`) and logs the result to stderr, so you can see immediately that this
  isn't mocked. Fire-and-forget — it never delays or blocks the MCP handshake. Set to `0` to disable.

## 5-line examples (per framework)

All of these run the **same** MCP server (`npx @fractalai/agent-passport-mcp`) over stdio and call the tools.

**LangChain (Python)** — `langchain-mcp-adapters`:
```python
from langchain_mcp_adapters.client import MultiServerMCPClient
client = MultiServerMCPClient({"agent_passport": {"command": "npx", "args": ["-y", "@fractalai/agent-passport-mcp"], "transport": "stdio"}})
tools = await client.get_tools()   # verify_passport, issue_passport, lookup_agent
agent = create_react_agent(model, tools)
await agent.ainvoke({"messages": "Verify passport https://fractalai.net.co/attestation/0x…"})
```

**CrewAI (Python)** — `crewai-tools` MCP adapter:
```python
from crewai_tools import MCPServerAdapter
from mcp import StdioServerParameters
params = StdioServerParameters(command="npx", args=["-y", "@fractalai/agent-passport-mcp"])
with MCPServerAdapter(params) as tools:
    Agent(role="Auditor", tools=tools, goal="Verify agent passports", backstory="...")
```

**AutoGen (Python)** — `autogen-ext` MCP workbench:
```python
from autogen_ext.tools.mcp import StdioServerParams, mcp_server_tools
params = StdioServerParams(command="npx", args=["-y", "@fractalai/agent-passport-mcp"])
tools = await mcp_server_tools(params)   # verify_passport / issue_passport / lookup_agent
agent = AssistantAgent("auditor", model_client=client, tools=tools)
```

**OpenAI Agents SDK (Python)**:
```python
from agents import Agent
from agents.mcp import MCPServerStdio
async with MCPServerStdio(params={"command": "npx", "args": ["-y", "@fractalai/agent-passport-mcp"]}) as server:
    agent = Agent(name="Auditor", instructions="Verify and issue agent passports.", mcp_servers=[server])
```

## Independent, no-framework verification

Because a receipt is designed for **third-party** verification, you don't even need this server (or
any FractalAI code) to check one — just `@noble/post-quantum` and the public key directory:

```js
import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js';

// 1. Pin the trusted key(s) from the signed, ML-DSA-65-governed directory (fetch once, cache):
const dir = await (await fetch('https://fractalai.net.co/.well-known/x402-receipt-keys')).json();
// (dir.signature / dir.directory_public_key let you verify the directory itself is unmodified —
// see @fractalai/pqc-agent-receipts-conformance for a full conformance-checked example.)

// 2. Given ANY served receipt — e.g. the response of a paid /api/x402/* call — verify offline:
const { signature, signed_message, public_key } = receipt; // fields returned by every x402 route
const valid = ml_dsa65.verify(
  Buffer.from(signature, 'base64'),
  new TextEncoder().encode(signed_message),
  Buffer.from(public_key, 'base64'),
);
console.log('receipt valid:', valid); // true only if the exact bytes were signed by that key
```

For a battle-tested, adversarially-vectored version of this same check (genuine + tampered +
wrong-key forgery vectors across x402/SAR/ACP/JOSE/W3C-VC profiles), see
[`@fractalai/pqc-agent-receipts-conformance`](https://www.npmjs.com/package/@fractalai/pqc-agent-receipts-conformance)
(`npx pqc-receipt-check`).

## License

MIT

## Automated commerce onboarding (0.2.5)

Call `list_fractalai_proofs` first. It returns the live catalog, payment requirements, input schemas and a supported MCP tool or an explicit HTTP integration path. Prices in discovery are informational: request a fresh challenge before authorizing a purchase. The MCP server does not hold buyer funds; automatic payment requires a compatible wallet client with a configured spending policy.

`witness_payment` accepts `seal_body`, optional `request_binding` and `settlement_tx`, and the standard x402 payment metadata. Build bound requests with the witness SDK; persist the request and authorization before submitting. The bridge forwards once and never creates a replacement authorization after a timeout. Verify delivered evidence using an independently trusted key. This tool does not replace the buyer's durable recovery store.

Run `npm run test:commerce` for deterministic MCP transport tests without network or payments.