agents-keys

Host Ed25519 keys for agents (`did:key`).
CLI only. The secret never leaves this machine, and never hits stdout.

Quickstart

pip install agents-keys

There is no init and no MCP server. Other loops shell out.

agents-keys mint <slug>

Writes ~/.agents/keys/<slug>.ed25519 (64-byte libsodium seed, mode 0600). Stdout is one did:key:z6Mk… line. The path is stderr.

Source checkouts can also be installed and managed with vand.

What it does

Mint or import a host key, derive did:key and an ssh-ed25519 line, sign a nonce, or answer a board challenge (prove).

resolve fetches a did.json or mailto home document. pin stores that did:key in a local TOFU ledger. A later resolve that disagrees with the pin fails.

The secret file is not printed, logged, or committed. Do not put it in a long-running server. Call this CLI as a subprocess.

CLI

Machine-readable catalog: python -m agents_keys --help-json (do not scrape --help).

prove accepts --verb, --handle, and --successor-did. When the board returns an event canonical, the JSON also includes event_signature.

agents-keys prove human https://board.example --verb bind-key --handle alice
agents-keys prove human https://board.example --verb move --handle alice --successor-did did:web:board.example:users:alice

No subcommand prints help.

Environment

ABI

Contract in abi/:

• WHY.md — host secret, public stdout
• LAYOUT.md — <slug>.ed25519 and did:key
• CLI.md — commands

Tests

python -m unittest discover -s tests -p "test_*.py"

License

MIT. See LICENSE.