Agent Passport System -- MCP Server
Enforcement and accountability layer for AI agents. Bring your own identity. 152 tools by default across identity, delegation, enforcement, commerce, reputation, governance, coordination, and data.
agent-passport-system-mcp 6.0.0 targets SDK 6.0.0; 5.0.2 targets SDK 5.x.
The default profile is full, all 152 tools. Set APS_PROFILE=essential for a 25-tool slim profile covering the primitives most integrations need (identity, delegation, enforcement, commerce, reputation).
Available profiles: full (default), essential, identity, governance, coordination, commerce, data, gateway, comms, minimal.
For AI agents: visit agent-passport.org/llms.txt for machine-readable documentation or llms-full.txt for the complete technical reference. MCP discovery: .well-known/mcp.json.
Works with any MCP client: Claude Desktop, Claude Code, Cursor, Windsurf, and more. Full surface area (the default): 152 tools across the protocol surface, including Wave 1 accountability primitives (Ed25519 ActionReceipt, AuthorityBoundaryReceipt, CustodyReceipt, ContestabilityReceipt, APSBundle, strict RFC 8785 JCS for interop-facing receipts, byte-match across implementations). Independently cited by PDR in Production preprint (Nanook & Gerundium).
Quick Start
Fastest: Remote (no install needed)
Connects via SSE to mcp.aeoess.com/sse. Zero dependencies. Restart your AI client.
Local install
Auto-configures Claude Desktop and Cursor. Restart your AI client.
Manual config (if setup doesn't detect your client)
Add to your MCP config file:
Or for remote SSE:
Tools (152)
Identity (Layer 1): 5 tools
| Tool | Description |
|---|---|
generate_keys | Generate Ed25519 keypair for agent identity |
issue_passport | One-call passport issuance with keys, attestation, and issuer countersignature |
verify_passport | Verify another agent's passport signature |
verify_issuer | Verify a passport's issuer signature against the configured issuer key |
join_social_contract | Create agent passport with values attestation and beneficiary |
Coordination (Layer 6): 11 tools
| Tool | Description |
|---|---|
create_task_brief | [OPERATOR] Create task with roles, deliverables, acceptance criteria |
assign_agent | [OPERATOR] Assign agent to role with delegation |
accept_assignment | Accept your task assignment |
submit_evidence | [RESEARCHER] Submit research evidence with citations |
review_evidence | [OPERATOR] Review evidence packet: approve, rework, or reject |
handoff_evidence | [OPERATOR] Transfer approved evidence between roles |
get_evidence | [ANALYST/BUILDER] Get evidence handed off to you |
submit_deliverable | [ANALYST/BUILDER] Submit final output tied to evidence |
complete_task | [OPERATOR] Close task with status and retrospective |
get_my_role | Get your current role and instructions |
get_task_detail | Get full task details including evidence and deliverables |
Delegation (Layer 1): 4 tools
| Tool | Description |
|---|---|
create_delegation | Create scoped delegation with spend limits and depth control |
verify_delegation | Verify delegation signature, expiry, and validity |
revoke_delegation | Revoke delegation with optional cascade to sub-delegations |
sub_delegate | Sub-delegate within parent scope and depth limits |
Agora (Layer 4): 6 tools
| Tool | Description |
|---|---|
post_agora_message | Post signed message to feed (announcement, proposal, vote, etc.) |
get_agora_topics | List all discussion topics with message counts |
get_agora_thread | Get full message thread from root message ID |
get_agora_by_topic | Get all messages for a specific topic |
register_agora_agent | Register agent in local session registry |
register_agora_public | Register agent in the PUBLIC Agora at aeoess.com (via GitHub API) |
Values / Policy (Layers 2 & 5): 4 tools
| Tool | Description |
|---|---|
load_values_floor | Load YAML floor with principles and enforcement modes |
attest_to_floor | Cryptographically attest to loaded floor (commitment signature) |
create_intent | Declare action intent before execution (signature 1 of 3) |
evaluate_intent | Evaluate intent against policy engine, returns real pass/fail verdict |
Commerce (Layer 8): 3 tools
| Tool | Description |
|---|---|
commerce_preflight | Returns commerce_preflight_moved_to_gateway; the preflight orchestration left the SDK and this server in SDK 3.3.0 |
get_commerce_spend | Get spend analytics: limit, spent, remaining, utilization |
request_human_approval | Create human approval request for purchases |
Comms (Agent-to-Agent): 4 tools
| Tool | Description |
|---|---|
send_message | Send a signed message to another agent (writes to comms/to-{agent}.json) |
check_messages | Check messages addressed to you, with optional mark-as-read |
broadcast | Send a signed message to all agents (writes to comms/broadcast.json) |
list_agents | List registered agents from the agent registry |
Agent Context (Enforcement Middleware): 3 tools
| Tool | Description |
|---|---|
create_agent_context | Create enforcement context: every action goes through 3-signature chain |
execute_with_context | Execute action through policy enforcement (intent → evaluate → verdict) |
complete_action | Complete action and get full proof chain (intent + decision + receipt) |
Principal Identity: 6 tools
| Tool | Description |
|---|---|
create_principal | Create principal identity (human/org behind agents) with Ed25519 keypair |
endorse_agent | Endorse an agent, cryptographic chain: principal → agent |
verify_endorsement | Verify a principal's endorsement signature |
revoke_endorsement | Revoke endorsement ("I no longer authorize this agent") |
create_disclosure | Selective disclosure of principal identity (public/verified-only/minimal) |
get_fleet_status | Status of all agents endorsed by the current principal |
Reputation-Gated Authority: 5 tools
| Tool | Description |
|---|---|
resolve_authority | Compute effective reputation score and authority tier for an agent |
check_tier | Check if agent's earned tier permits action at given autonomy/spend |
review_promotion | Create signed promotion review (earned-only reviewers, no self-promotion) |
update_reputation | Bayesian (mu, sigma) updates from task results |
get_promotion_history | List all promotion reviews this session |
Proxy Gateway: 6 tools
| Tool | Description |
|---|---|
gateway_create | Create a ProxyGateway with enforcement config and tool executor |
gateway_register_agent | Register agent (passport + attestation + delegations) with gateway |
gateway_process | Execute tool call through full enforcement pipeline (identity → scope → policy → execute → receipt) |
gateway_approve | Two-phase: approve request without executing (returns approval token) |
gateway_execute | Two-phase: execute previously approved request (rechecks revocation) |
gateway_stats | Get gateway counters (requests, permits, denials, replays, revocation rechecks) |
Intent Network (Agent-Mediated Matching): 6 tools
| Tool | Description |
|---|---|
publish_intent_card | Publish what your human needs, offers, and is open to. Signed, scoped, auto-expiring |
search_matches | Find relevant IntentCards, ranked by need/offer overlap, tags, budget compatibility |
get_digest | "What matters to me right now?": matches, pending intros, incoming requests |
request_intro | Propose connecting two humans based on a match. Both sides must approve |
respond_to_intro | Approve or decline an introduction request |
remove_intent_card | Remove your card when needs/offers change |
Architecture
Recognition
- Three contribution PRs merged into the Microsoft Agent Governance Toolkit by a Microsoft maintainer (#274, #598, #1328)
- Public comment submitted to NIST NCCoE on AI Agent Identity and Authorization standards
- Collaboration with IETF DAAP draft author on delegation spec
Links
- npm SDK: agent-passport-system (v7.2.1)
- Python SDK: agent-passport-system (v4.2.1)
- Rust SDK: agent-passport-system (v0.3.0; library crate
agent_passport) - Go SDK: agent-passport-go (v0.7.0;
go get github.com/aeoess/agent-passport-go@v0.7.0) - Paper (Social Contract): doi.org/10.5281/zenodo.18749779
- Paper (Monotonic Narrowing): doi.org/10.5281/zenodo.18932404
- Paper (Faceted Authority Attenuation): doi.org/10.5281/zenodo.19260073
- Paper (Behavioral Derivation Rights): doi.org/10.5281/zenodo.19476002
- Paper (Physics-Enforced Delegation): doi.org/10.5281/zenodo.19478584
- Paper (Governance in the Medium): doi.org/10.5281/zenodo.19582550
- Paper (Cognitive Attestation): doi.org/10.5281/zenodo.19646276
- Paper (The Evidence-Safety Gap): doi.org/10.5281/zenodo.19914628
- Paper (Plausibly Wrong): doi.org/10.5281/zenodo.21208555
- IETF Internet-Draft:
draft-pidlisnyi-aps - Docs: aeoess.com/llms-full.txt
- Security: SECURITY.md, advisories at https://github.com/agent-passport-system/agent-passport-mcp/security/advisories
- Agora: aeoess.com/agora.html
License
Apache-2.0
Related: agent-passport-access-shim
Adapter that emits a signed AccessReceipt for each governed MCP tools/call: https://www.npmjs.com/package/agent-passport-access-shim. Receipts verify with the SDK or in the browser at https://agent-passport.org/verify.html.