# uuaid/uuaid [Health: Active]

**Category:** 🧠 Knowledge & Memory  
**Repository:** https://github.com/uuaid/uuaid  
**GitHub Stars:** 0  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mcp-333

## Description
Permanent identity + encrypted, quantum-ready memory that outlives the session, for any AI agent.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "uuaid": {
    "command": "npx",
    "args": ["-y","@uuaid/cli"]
  }
}
```

## Documentation & README

# UUAID

**The verifiable identity layer for AI agents — the SSL/CA for agents.**

A permanent, portable identity plus encrypted, quantum-ready memory that outlives
the session. This monorepo holds the official TypeScript packages; the hosted
registry, resolver, and on-chain anchor run at [uuaid.org](https://uuaid.org).

Protocol specifications live in [uuaid/spec](https://github.com/uuaid/spec).
The design argument, including the vulnerability we found in our own verifier,
is at [uuaid.org/know-your-agent](https://uuaid.org/know-your-agent).

## Packages

| Package | npm | What |
|---|---|---|
| [`@uuaid/core`](https://github.com/uuaid/uuaid/blob/HEAD/packages/uuaid-core) | [`@uuaid/core`](https://npmjs.com/package/@uuaid/core) | UUAID grammar, JCS content hashing, crypto-agile signature envelope, Verifiable Badges (IAASO-0003) |
| [`@uuaid/vault`](https://github.com/uuaid/uuaid/blob/HEAD/packages/vault) | [`@uuaid/vault`](https://npmjs.com/package/@uuaid/vault) | Client-side memory encryption (AES-256-GCM + hybrid X25519/ML-KEM-768) |
| [`@uuaid/sdk`](https://github.com/uuaid/uuaid/blob/HEAD/packages/sdk) | [`@uuaid/sdk`](https://npmjs.com/package/@uuaid/sdk) | Typed client: signup, mint, save/recall memory, verify |
| [`@uuaid/provenance`](https://github.com/uuaid/uuaid/blob/HEAD/packages/provenance) | [`@uuaid/provenance`](https://npmjs.com/package/@uuaid/provenance) | Media provenance (IAASO-0004) — bind an image, video or PDF to the agent that made it |
| [`@uuaid/cli`](https://github.com/uuaid/uuaid/blob/HEAD/packages/cli) | [`@uuaid/cli`](https://npmjs.com/package/@uuaid/cli) | `uuaid signup · register · badge · verify-badge · vault …` |
| [`@uuaid/mcp`](https://github.com/uuaid/uuaid/blob/HEAD/packages/mcp) | [`@uuaid/mcp`](https://npmjs.com/package/@uuaid/mcp) | MCP server — one config line makes any agent persistent |

## Quickstart

```bash
npx @uuaid/cli signup "my-lab"     # free API key, shown once
npx @uuaid/cli register "ci-bot"   # permanent ID
```

```ts
import { UuaidClient, generateVaultKey } from "@uuaid/sdk";

const { api_key } = await UuaidClient.signup("My Agent Lab"); // free tier
const uuaid = new UuaidClient({ apiKey: api_key });
const { uuaid: id } = await uuaid.registerAgent({ display_name: "Aria" });
```

## Verifying a badge

The one thing to get right, so it is worth stating before the code: **a badge
envelope carries the signer's own public key.** Well-formedness, the payload-hash
bind, signature validity, even a valid post-quantum signature — all of them pass
for a badge anybody minted with a fresh keypair and a copied `keyId`. Pinning the
issuer against a published root is the only step that turns a valid signature
into an identity claim.

`verifyBadge` therefore fails closed. No pin, no verdict.

```ts
import { parseBadgeSvg, verifyBadge } from "@uuaid/core";

const { keys } = await fetch("https://api.uuaid.org/.well-known/uuaid-registry.json").then(r => r.json());
const trustedIssuerKeys = Object.fromEntries(keys.map(k => [k.keyId, k.publicKey]));

const r = verifyBadge(parseBadgeSvg(svg), { trustedIssuerKeys });
r.ok            // true only when the issuer pinned and the envelope is intact
r.level         // "L1-trusted" | "L0-selfsigned" | "invalid" | …
r.nameVerified  // did the registry vouch for the NAME on it? usually false
```

Omit `trustedIssuerKeys` and you get `ok: false`, `level: "L0-selfsigned"` — the
level a forgery reaches. See
[IAASO-0003 §4.3](https://github.com/uuaid/spec/blob/main/IAASO-0003-verifiable-badge-and-presentation-protocol.md#43-trust-root).

## Development

```bash
pnpm install
pnpm build && pnpm typecheck && pnpm test
```

## Security

Found a badge that verifies and shouldn't? That is the most useful thing you can
send us — [security@uuaid.org](mailto:security@uuaid.org), and see
[SECURITY.md](https://github.com/uuaid/uuaid/blob/HEAD/SECURITY.md).

Apache-2.0 — see [LICENSE](https://github.com/uuaid/uuaid/blob/HEAD/LICENSE).