agent-identity-protocol

Verifiable cryptographic identity and delegation for AI agents, across MCP and A2A.

Python reference implementation of the Agent Identity Protocol (AIP), specified in draft-prakash-aip-01.

Install

pip install agent-identity-protocol

Framework adapters for CrewAI, Google ADK, and LangChain live in the separate aip-agents package.

What it does

Agents get an Ed25519 keypair and a verifiable identifier. Authority is delegated in chains where each hop can only narrow scope, budget, and expiry, never widen them. Any party can verify a chain offline from the token and the issuer's published key, with no callback to the originating organization.

Two token modes:

Compact (JWT) for single-hop calls where no delegation is needed.
Chained (Biscuit) for multi-hop delegation with per-hop attenuation.

Quickstart

from aip_core.crypto import KeyPair
from aip_token.chained import ChainedToken

root = KeyPair.generate()

authority = ChainedToken.create_authority(
    issuer="aip:web:example.com/agents/orchestrator",
    scopes=["tool:search", "tool:browse"],
    budget_cents=500,
    max_depth=3,
    ttl_seconds=3600,
    keypair=root,
)

# Narrow on the way down. Widening is refused.
delegated = authority.delegate(
    delegator="aip:web:example.com/agents/orchestrator",
    delegate="aip:web:example.com/agents/researcher",
    scopes=["tool:search"],
    budget_cents=100,
    context="research subtask for quarterly report",
)

delegated.authorize("tool:search", root.public_key_bytes())   # ok
delegated.authorize("tool:browse", root.public_key_bytes())   # raises

Verification

authorize() runs the algorithm in draft-prakash-aip-01 Section 4: it re-verifies every block signature from the serialized form, walks the chain confirming each hop narrows its parent across scope, budget, expiry and principal, requires a non-empty delegation context, and then evaluates policy.

An AIP token is a bearer credential. Verification establishes what authority the chain conveys and that no hop exceeded its predecessor. It does not establish that the presenting party is the one the token was issued to; that requires binding the token to a key at the transport or message layer.

Documentation

Protocol specification: github.com/sunilp/aip
MCP proxy, framework guides, security model: sunilprakash.com/aip
Paper: arXiv:2603.24775 (preprint)

License

Apache-2.0

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

agent_identity_protocol-0.5.0.tar.gz (50.8 kB view details)

Uploaded Aug 23, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

agent_identity_protocol-0.5.0-py3-none-any.whl (35.2 kB view details)

Uploaded Aug 23, 2026 Python 3

File details

Details for the file agent_identity_protocol-0.5.0.tar.gz.

File metadata

Download URL: agent_identity_protocol-0.5.0.tar.gz
Upload date: Aug 23, 2026
Size: 50.8 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for agent_identity_protocol-0.5.0.tar.gz
Algorithm	Hash digest
SHA256	`63554a6b490d8882b984995ee3cc58644221b5b346dbd76d0847cc11438d08b3`
MD5	`ac1233a73a6fce88adb7fd029ced1544`
BLAKE2b-256	`23930cec6e8cb48d583f666c75317f3d50caf1626e877bed92ab7f8b7dbfa384`

See more details on using hashes here.

Provenance

The following attestation bundles were made for agent_identity_protocol-0.5.0.tar.gz:

Publisher: publish-core.yml on sunilp/aip

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: agent_identity_protocol-0.5.0.tar.gz
- Subject digest: 63554a6b490d8882b984995ee3cc58644221b5b346dbd76d0847cc11438d08b3
- Sigstore transparency entry: 2574408445
- Sigstore integration time: Aug 23, 2026
Source repository:
- Permalink: sunilp/aip@0ad099d354561b750517827b519f34eac98af98b
- Branch / Tag: refs/tags/aip-core-v0.5.0
- Owner: https://github.com/sunilp
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: publish-core.yml@0ad099d354561b750517827b519f34eac98af98b
- Trigger Event: push