Host Ed25519 keys for agents (`did:key`).
CLI only. The secret never leaves this machine, and never hits stdout.
Quickstart
pip install agents-keys
There is no init and no MCP server. Other loops shell out.
agents-keys mint <slug>
Writes ~/.agents/keys/<slug>.ed25519 (64-byte libsodium seed, mode 0600). Stdout is one did:key:z6Mk… line. The path is stderr.
Source checkouts can also be installed and managed with vand.
What it does
Mint or import a host key, derive did:key and an ssh-ed25519 line, sign a nonce, or answer a board challenge (prove).
resolve fetches a did.json or mailto home document. pin stores that did:key in a local TOFU ledger. A later resolve that disagrees with the pin fails.
The secret file is not printed, logged, or committed. Do not put it in a long-running server. Call this CLI as a subprocess.
CLI
Machine-readable catalog: python -m agents_keys --help-json (do not scrape --help).
| Command | Purpose |
|---|---|
agents-keys mint <slug> |
New key file. Stdout: did:key |
agents-keys import <slug> <path> |
Unencrypted OpenSSH or libsodium secret. Stdout: did:key |
agents-keys did <slug> |
did:key from an existing file |
agents-keys ssh-pubkey <slug> |
One ssh-ed25519 public line |
agents-keys sign <slug> <nonce> |
Ed25519 signature hex over the nonce |
agents-keys prove <slug> <board-url> |
Fetch a challenge, print {did, nonce, signature} |
agents-keys resolve <locator> |
Fetch a home document, print keys JSON |
agents-keys pin <locator> |
Resolve and TOFU-pin into known-dids.jsonl |
prove accepts --verb, --handle, and --successor-did. When the board returns an event canonical, the JSON also includes event_signature.
agents-keys prove human https://board.example --verb bind-key --handle alice
agents-keys prove human https://board.example --verb move --handle alice --successor-did did:web:board.example:users:alice
No subcommand prints help.
Environment
| Variable | Default | Description |
|---|---|---|
AGENTS_KEYS_DIR |
~/.agents/keys |
Host secret files (<slug>.ed25519) |
AGENTS_KNOWN_DIDS |
~/.agents/known-dids.jsonl |
TOFU pins for external DIDs |
ABI
Contract in abi/:
Tests
python -m unittest discover -s tests -p "test_*.py"
License
MIT. See LICENSE.
Release files for agents-keys 0.0.3
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| agents_keys-0.0.3.tar.gz | 16.1 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| agents_keys-0.0.3-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 31.4 kB
Release files / agents_keys-0.0.3.tar.gz
| Download URL | agents_keys-0.0.3.tar.gz |
|---|---|
| Size | 16.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
cebdc51a8761c212c983b0394150268806e6e41fdf2945ebe3fcc7215faa62f7
|
|
BLAKE2b-256 checksum How to use checksums |
72bd5255d08235e1d7a7cb2db653fa5887159b2b6cf4d38c9fa495d748620ec1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.10.6
|
Release files / agents_keys-0.0.3-py3-none-any.whl
| Download URL | agents_keys-0.0.3-py3-none-any.whl |
|---|---|
| Size | 15.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
863bf2fb6c3f566796cb500a39eae4e5721222eaf9b1f699148b57904a19c6e0
|
|
BLAKE2b-256 checksum How to use checksums |
46a4d889ad680c7f99d9b4eec200ea69fe23933e7d8930632157482e89772902
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.10.6
|
