Vouch Protocol™

_{Vouch Protocol™ is a common-law trademark.}

The Open Standard for Identity & Provenance of AI Agents

Quick Start

# Install (Linux and macOS). On Windows, use: pip install vouch-protocol
curl -fsSL https://vouch-protocol.com/install.sh | sh

# Run vouch with no arguments and pick what you want to do
vouch

Prefer to do it by hand? It is three commands:

pip install vouch-protocol

# One command to configure SSH signing + Vouch branding
vouch git init

# All future commits are now signed and show ✅ Verified on GitHub
git commit -m "Secure commit"

Setting up an agent instead of git signing? vouch onboard --quick generates a working identity, allow-list, verifier, and heartbeat config in one command.

What's New in v1.0

Vouch Protocol v1.0 aligns directly with the open standard:

• Verifiable Credentials as the credential format (replacing v0.x JWS tokens).
• Data Integrity proofs with the eddsa-jcs-2022 cryptosuite (no JOSE, no Base64-wrapped payload, the credential remains human-readable JSON).
• Multikey verification methods in DID Documents (algorithm-agnostic, ML-DSA-44 ready).
• Post-quantum profile as a Data Integrity proof set: the credential carries two independent proofs, eddsa-jcs-2022 and mldsa44-jcs-2024, an optional add-on for regulated deployments aligning with NIST CNSA 2.0 / NSM-10 timelines.
• Three-way cross-implementation interop verified across Python, TypeScript, and Go.

Credentials are issued with Signer.sign() and checked with Verifier.verify(). See the Specification at vouch-protocol.com/specs/SPEC/ for the full specification.

The Open Standard for AI Agent Identity & Accountability

When Anthropic launched MCP, they solved "how agents call tools." They didn't solve "how we TRUST those agents."

Vouch Protocol is the SSL certificate for AI agents.

Vouch is not one tool, it is a set of them. Here is the whole map.

On the command line

• vouch init generate an agent identity (a DID and keypair).
• vouch sign / vouch verify sign a payload and verify it.
• vouch git sign every git commit cryptographically, set up in one command, with a verified badge for your README.
• vouch scan find leaked Vouch key material in your code before it ships (a private key in a file, a seed in an env var, a DID document that accidentally carries a private key).
• vouch attribute separate who wrote which line. When an AI assistant and a human both edit a file, this records the AI's lines under the AI's own key and your lines under yours, so when a line causes an incident you can prove which of you wrote it. See the Claude Code integration.
• vouch media sign images, with C2PA support.

For your agents

• MCP server (vouch-mcp) a standalone Model Context Protocol server so any MCP client (Claude Desktop, Cursor, any agent) can create an identity, sign and verify credentials, scan for leaked keys, and decode DIDs, out of the box.
• Identity Sidecar keeps signing keys out of the model's context, so a prompt injection cannot read them.
• Vouch Shield a runtime check that inspects every tool call against your rules, like a customs officer at the door.
• Continuous trust heartbeats and session vouchers, so trust is a live signal that has to be renewed, not a badge that is issued once and trusted forever.
• Authority freshness a signed authority state with a counter that only goes up, so a state change (a fraud signal, a suspended mandate) collapses the acceptable freshness window to now for a high-consequence action, even when time-decay trust still passes. See docs/authority-freshness.md.

Framework integrations (new in v1.6.2)

Standalone packages that drop Vouch into the agent framework you already use. Each one issues a verifiable credential for a tool call, with optional delegation back to a human principal.

• vouch-langchain a LangChain tool that signs each tool call before it leaves the agent.
• vouch-langgraph signs LangGraph tool calls and graph nodes, so a signed trail runs across the whole graph.
• vouch-crewai a CrewAI tool, with supervisor-to-worker delegation that can only narrow authority, never widen it.
• vouch-a2a binds an A2A (Agent2Agent) Agent Card to a Vouch identity, so two agents can verify each other before they collaborate.
• vouch-goose registers the Vouch MCP server as an extension for Block's Goose agent, so a Goose session can sign and verify out of the box.
• vouch-mlflow signs an MLflow model artifact at registration time, bound to a content digest so any change to the weights breaks the signature.
• vouch-safetensors embeds a credential in a .safetensors header, complementary to OpenSSF Model Signing, so a model carries who produced it.

The standalone vouch-mcp package above ships alongside these in v1.6.2.

SDKs, in the language you use

Python, TypeScript, and Go are the full reference implementations. A Rust core with idiomatic Swift, JVM (Java and Kotlin), .NET, and C wrappers shares one codebase, so every language produces byte-identical output, verified against shared test vectors. A WebAssembly build is included for the browser and the edge. See the table further down for status per language.