agent-protocols

module
v0.6.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 27, 2026 License: MIT

README

Agent Protocols

Go CI Go Lint Go SAST Go Report Card Docs Docs Visualization License

Go implementation of agent-to-agent communication protocols for AI agent authentication and authorization.

EXPERIMENTAL: This library implements draft specifications that are subject to change.

Overview

This repository provides Go libraries for emerging agent-to-agent protocols:

Server Implementations

Interface-based authorization servers (bring your own storage):

For production deployments with SQLite/DynamoDB storage, see plexusone/agentauth.

Cross-Protocol Bridge
  • bridge - Cross-protocol interoperability with unified identity representation
    • Multi-protocol HTTP middleware accepting ID-JAG, AIMS, and AAuth
    • Canonical Identity type for protocol-agnostic code
    • Protocol detection and token parsing
  • bridge/observe - Observability integration via OmniObserve
    • Distributed tracing with auth spans
    • Metrics: auth.requests, auth.success, auth.failure, auth.duration
    • Structured logging with identity context
Adapters

Production-ready integrations with identity infrastructure:

Installation

go get github.com/aistandardsio/agent-protocols

Quick Start

AAuth - HTTP Message Signatures
import "github.com/aistandardsio/agent-protocols/aauth"

// Create agent with cryptographic identity
agentID, _ := aauth.NewAAuthID("calendar-bot", "example.com")
agent, _ := aauth.NewAgent(agentID, privateKey,
    aauth.WithAgentProviderURL("https://agents.example.com"))

// Create signed HTTP request
req, _ := agent.SignedRequest(ctx, "GET", "https://api.example.com/events", nil)

// Or use automatic signing transport
client := &http.Client{Transport: agent.Transport(nil)}
resp, _ := client.Get("https://api.example.com/events")
ID-JAG - Token Exchange
import "github.com/aistandardsio/agent-protocols/idjag"

// Create assertion for token exchange
assertion := idjag.NewAssertion(
    "https://issuer.example.com",
    "agent:calendar-bot",
    []string{"https://auth.example.com"},
    5 * time.Minute,
)

// Exchange for access token
client := idjag.NewTokenExchangeClient("https://auth.example.com/token")
resp, _ := client.ExchangeAssertion(ctx, signedAssertion, "read:data")
AIMS - Workload Identity
import "github.com/aistandardsio/agent-protocols/aims"

// Create SPIFFE ID for agent
spiffeID, _ := aims.NewSPIFFEID("example.com", "/agent/calendar-bot")

// Create Workload Identity Token
wit := aims.NewWIT(spiffeID, []string{"https://api.example.com"}, 1*time.Hour)
signedWIT, _ := wit.Sign(privateKey, "key-1")

Examples

Each protocol includes working demos:

AAuth:

go run ./aauth/examples/simple      # Agent authentication
go run ./aauth/examples/delegation  # Human-to-agent delegation

ID-JAG:

go run ./idjag/examples/simple      # Agent-only flow
go run ./idjag/examples/delegation  # Human-to-agent delegation

AIMS:

go run ./aims/examples/simple       # WIT/WPT authentication
go run ./aims/examples/mtls         # mTLS with X.509 SVID

Zitadel Adapter:

go run ./adapters/zitadel/examples/idjag  # ID-JAG token exchange
go run ./adapters/zitadel/examples/aims   # AIMS WIT verification
go run ./adapters/zitadel/examples/aauth  # AAuth agent authentication

SharkAuth Adapter:

go run ./adapters/sharkauth/examples/aauth  # AAuth with delegation grants

Ory Adapter:

go run ./adapters/ory/examples/idjag  # ID-JAG with Hydra

Cross-Protocol Bridge:

go run ./demos/protocol-bridge  # Multi-protocol authentication demo

Documentation

Development

# Run unit tests
go test ./...

# Run linter
golangci-lint run

# Run integration tests (all protocol examples)
./scripts/integration-test.sh

# Run integration tests (quick mode - core protocols only)
./scripts/integration-test.sh --quick

License

MIT License - see LICENSE for details.

Directories

Path Synopsis
Package aauth implements the AAuth protocol for agent-to-resource authentication.
 Package aauth implements the AAuth protocol for agent-to-resource authentication.
examples/delegation command
Package main demonstrates the AAuth delegation flow.
 Package main demonstrates the AAuth delegation flow.
examples/resource-managed command
Package main demonstrates the AAuth resource-managed flow.
 Package main demonstrates the AAuth resource-managed flow.
examples/simple command
Package main demonstrates the AAuth identity-only flow.
 Package main demonstrates the AAuth identity-only flow.
httpsig
Package httpsig implements HTTP Message Signatures per RFC 9421.
 Package httpsig implements HTTP Message Signatures per RFC 9421.
personserver
Package personserver implements the AAuth Person Server.
 Package personserver implements the AAuth Person Server.
adapters
ory
Package ory provides integration between agent-protocols and Ory infrastructure.
 Package ory provides integration between agent-protocols and Ory infrastructure.
ory/examples/idjag command
Package main demonstrates ID-JAG integration with Ory Hydra.
 Package main demonstrates ID-JAG integration with Ory Hydra.
ory/fosite
Package fosite provides custom OAuth 2.0 grant handlers for Ory Fosite.
 Package fosite provides custom OAuth 2.0 grant handlers for Ory Fosite.
ory/hydra
Package hydra provides a client for Ory Hydra's APIs with agent token support.
 Package hydra provides a client for Ory Hydra's APIs with agent token support.
sharkauth
Package sharkauth provides adapters integrating agent-protocols with SharkAuth, a purpose-built OAuth 2.0 server for agent delegation.
 Package sharkauth provides adapters integrating agent-protocols with SharkAuth, a purpose-built OAuth 2.0 server for agent delegation.
sharkauth/examples/aauth command
Package main demonstrates AAuth protocol integration with SharkAuth.
 Package main demonstrates AAuth protocol integration with SharkAuth.
zitadel
Package zitadel provides production-quality adapters integrating agent-protocols with Zitadel OIDC infrastructure.
 Package zitadel provides production-quality adapters integrating agent-protocols with Zitadel OIDC infrastructure.
zitadel/examples/aauth command
Package main demonstrates AAuth agent authentication with Zitadel.
 Package main demonstrates AAuth agent authentication with Zitadel.
zitadel/examples/aims command
Package main demonstrates AIMS Workload Identity Token verification with Zitadel.
 Package main demonstrates AIMS Workload Identity Token verification with Zitadel.
zitadel/examples/idjag command
Package main demonstrates ID-JAG assertion exchange with Zitadel.
 Package main demonstrates ID-JAG assertion exchange with Zitadel.
Package agentauth provides a unified authorization layer for AI agents.
 Package agentauth provides a unified authorization layer for AI agents.
client
Package client provides a Go SDK for agents to interact with AgentAuth servers.
 Package client provides a Go SDK for agents to interact with AgentAuth servers.
Package aims implements the Agent Identity Management System (AIMS) framework based on draft-klrc-aiagent-auth-00.
 Package aims implements the Agent Identity Management System (AIMS) framework based on draft-klrc-aiagent-auth-00.
examples/mtls command
Package main demonstrates AIMS agent authentication using mTLS with X.509 SVID.
 Package main demonstrates AIMS agent authentication using mTLS with X.509 SVID.
examples/simple command
Package main demonstrates basic AIMS agent authentication with SPIFFE ID.
 Package main demonstrates basic AIMS agent authentication with SPIFFE ID.
Package bridge provides cross-protocol bridging for agent-protocols.
 Package bridge provides cross-protocol bridging for agent-protocols.
observe
Package observe provides observability integration for the bridge package using the omniobserve library.
 Package observe provides observability integration for the bridge package using the omniobserve library.
demos
multi-protocol command
Package main demonstrates all three agent authentication protocols.
 Package main demonstrates all three agent authentication protocols.
protocol-bridge command
Package main demonstrates cross-protocol bridging capabilities.
 Package main demonstrates cross-protocol bridging capabilities.
Package idjag implements Identity Assertion JWT Authorization Grant (ID-JAG) based on draft-ietf-oauth-identity-assertion-authz-grant.
 Package idjag implements Identity Assertion JWT Authorization Grant (ID-JAG) based on draft-ietf-oauth-identity-assertion-authz-grant.
authzserver
Package authzserver implements the ID-JAG Authorization Server.
 Package authzserver implements the ID-JAG Authorization Server.
examples/delegation command
Package main demonstrates ID-JAG with human-to-agent delegation.
 Package main demonstrates ID-JAG with human-to-agent delegation.
examples/simple command
Package main demonstrates a simple ID-JAG token exchange flow without delegation.
 Package main demonstrates a simple ID-JAG token exchange flow without delegation.
Package scimext provides a Go client for the SCIM Agent Extension API.
 Package scimext provides a Go client for the SCIM Agent Extension API.
agents
Package agents provides operations for managing SCIM Agent resources.
 Package agents provides operations for managing SCIM Agent resources.
applications
Package applications provides operations for managing SCIM AgenticApplication resources.
 Package applications provides operations for managing SCIM AgenticApplication resources.
examples/simple command
Package main demonstrates basic usage of the SCIM Agent Extension client.
 Package main demonstrates basic usage of the SCIM Agent Extension client.
internal/api
Code generated by ogen, DO NOT EDIT.
 Code generated by ogen, DO NOT EDIT.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.