AI agents need their own SSL. Here's why I built it.

#mcp #security #ai #webdev

In 1995, Netscape released SSL. The web didn't really take off commercially until then. Before SSL, you couldn't trust a website with your credit card. After SSL, e-commerce exploded.

AI agents are at the same inflection point in 2026. Here's why.

The problem

Agents are starting to call each other autonomously. Each hop is a trust decision. But agents have no way to verify each other.

Today, when Agent A calls Agent B:

Is Agent B who it claims to be? No way to verify
Has Agent B been audited for security? No standard
Has Agent B's key been compromised? No revocation mechanism

This is exactly where the web was in 1994. No SSL, no trust, no commerce.

The analogy

Web (1995)	Agents (2026)
HTTP (transport)	A2A + MCP (transport)
No HTTPS = can't trust	No ATC = can't trust
SSL certificate	ATC Trust Card
Certificate Authority	MarketNow Sentinel CA
Revocation list (CRL)	/api/atc?action=verify

What I built

ATC (Agent Trust Card) — SSL certificates for AI agents.

How it works

Agent registers with MarketNow CA
CA signs the agent's identity with Ed25519
Agent presents its ATC to other agents
Other agents verify the signature with the CA public key
If compromised, the CA revokes the ATC

Real cryptography (not a mock)

Ed25519 signatures (RFC 8032)
CA private key in Vercel env var (never exposed)
CA public key committed to public GitHub repo
Every ATC persisted as signed JSON in _data/atc/
Anyone can verify signatures offline using crypto.verify

Sentinel integration

The ATC's trust score comes from Sentinel — the 8-layer security audit pipeline:

L1.5: metadata checks
L1.6: Semgrep + secrets + OSV
L1.7: binary/malware detection
L1.8: malware family signatures (Emotet, Cobalt Strike, etc.)

The positioning

MarketNow is not competing with A2A or MCP. It's the trust layer that sits on top:

ATC (Trust Layer)              <- MarketNow
A2A / MCP (Transport Layer)    <- Google / Anthropic
HTTP / WebSocket (Network)     <- Standard

Every agent with an A2A card can have an ATC Trust Card. Every MCP skill can have a Sentinel Certificate. Complementary, not competitive.

Try it

# Get the CA public key
curl https://marketnow.site/api/atc?action=ca-key

# Issue a trust card for your agent
curl -X POST https://marketnow.site/api/atc \
  -H "Content-Type: application/json" \
  -d '{"action":"issue","agent_id":"your.agent","public_key":"your-ed25519-pubkey"}'

# Verify any agent's trust card
curl "https://marketnow.site/api/atc?action=verify&card_id=ATC-2026-XXXXXXX"