agents-keys
Host Ed25519 keys for agents (`did:key`).
CLI only. The secret never leaves this machine, and never hits stdout.
Quickstart
pip install agents-keys
There is no init and no MCP server. Other loops shell out.
agents-keys mint <slug>
Writes ~/.agents/keys/<slug>.ed25519 (64-byte libsodium seed, mode 0600). Stdout is one did:key:z6Mk… line. The path is stderr.
Source checkouts can also be installed and managed with vand.
What it does
Mint or import a host key, derive did:key and an ssh-ed25519 line, sign a nonce, or answer a board challenge (prove).
resolve fetches a did.json or mailto home document. pin stores that did:key in a local TOFU ledger. A later resolve that disagrees with the pin fails.
The secret file is not printed, logged, or committed. Do not put it in a long-running server. Call this CLI as a subprocess.
CLI
Machine-readable catalog: python -m agents_keys --help-json (do not scrape --help).
| Command | Purpose |
|---|---|
agents-keys mint <slug> |
New key file. Stdout: did:key |
agents-keys import <slug> <path> |
Unencrypted OpenSSH or libsodium secret. Stdout: did:key |
agents-keys did <slug> |
did:key from an existing file |
agents-keys ssh-pubkey <slug> |
One ssh-ed25519 public line |
agents-keys sign <slug> <nonce> |
Ed25519 signature hex over the nonce |
agents-keys prove <slug> <board-url> |
Fetch a challenge, print {did, nonce, signature} |
agents-keys resolve <locator> |
Fetch a home document, print keys JSON |
agents-keys pin <locator> |
Resolve and TOFU-pin into known-dids.jsonl |
prove accepts --verb, --handle, and --successor-did. When the board returns an event canonical, the JSON also includes event_signature.
agents-keys prove human https://board.example --verb bind-key --handle alice
agents-keys prove human https://board.example --verb move --handle alice --successor-did did:web:board.example:users:alice
No subcommand prints help.
Environment
| Variable | Default | Description |
|---|---|---|
AGENTS_KEYS_DIR |
~/.agents/keys |
Host secret files (<slug>.ed25519) |
AGENTS_KNOWN_DIDS |
~/.agents/known-dids.jsonl |
TOFU pins for external DIDs |
ABI
Contract in abi/:
Tests
python -m unittest discover -s tests -p "test_*.py"
License
MIT. See LICENSE.
Release files for agents-keys 0.0.4
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| agents_keys-0.0.4.tar.gz | 17.8 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| agents_keys-0.0.4-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 33.9 kB
Release files / agents_keys-0.0.4.tar.gz
| Download URL | agents_keys-0.0.4.tar.gz |
|---|---|
| Size | 17.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ef5a4c10cb3aa1bcb56d8c1f59d3e6f89b6c0da2574a6591811102c0e873ad91
|
|
BLAKE2b-256 checksum How to use checksums |
0f57b264a8492d971f91f749b0fd574f15d8afba71f0773e7a745c4b6e58c6ed
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.12.5 {"installer":{"name":"uv","version":"0.12.5","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":null,"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}
|
Release files / agents_keys-0.0.4-py3-none-any.whl
| Download URL | agents_keys-0.0.4-py3-none-any.whl |
|---|---|
| Size | 16.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
bf15db9cc9cae67fed03e732065b2bf392e0d0fc8d20b5d4b0cbbd5a7ed7a5b6
|
|
BLAKE2b-256 checksum How to use checksums |
e63a459a27de20562d41e88c5be20b7fa6c2438c5d4c4a1b0d16822056f26950
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.12.5 {"installer":{"name":"uv","version":"0.12.5","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":null,"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":null}
|
Security for agents-keys 0.0.4
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
