I have been building AI agents for a while. They call models. They query databases. They hit APIs. They do useful things.
None of them could prove who they were.
I built AgentPass to fix that. Every agent gets a cryptographic identity, a trust level, and signed evidence of every action it takes. I want to show you how it works, because the setup takes about two minutes and changes how you think about agent security.
The problem in one sentence
Your AI agent has the same access as whatever credentials it was given. Nothing checks whether it should be running DELETE instead of SELECT. Nothing signs what it did. Nothing survives if someone asks "what happened?"
Install
npm install -g @proofxhq/agentpass
Add to your Claude Desktop config (or Cursor, Codex, Windsurf):
{
"mcpServers": {
"agentpass": {
"command": "npx",
"args": ["@proofxhq/agentpass"],
"env": {
"AGENTPASS_URL": "https://secureagents.agentpass.co.uk"
}
}
}
}
Restart. You now have seven tools available in your LLM.
Create your first agent
Paste this into Claude or any MCP client:
Create an AI agent called "my-scanner" with capabilities read and query.
What happens: AgentPass generates an ECDSA P-256 key pair on your machine. The private key never leaves. A certificate signing request goes to the API. You get back a signed X.509 certificate with your agent's trust level and capabilities embedded as OID extensions under IANA Private Enterprise Number 66339.
Your agent now has an identity that any system can verify offline.
Trust levels
Every agent gets a trust level based on its capabilities:
- L0: read-only, monitoring
- L1: standard operations, read data
- L2: write data, multi-step workflows
- L3: financial, medical, legal operations
- L4: destructive actions, human approval required
A marketing bot at L1 cannot call a clinical notes model that requires L4. The request is refused before it reaches the model. Not logged after the fact. Refused before.
Sign an action
Using my-scanner, sign an action to scan example.com. Show me the signature.
The agent's local private key signs the action payload with a nonce and timestamp. The signature is verified server-side. This is MCPS per-action signing. Cryptographic proof that this specific agent authorised this specific action at this specific time.
Revoke a compromised agent
my-scanner has been compromised. Revoke it immediately.
Revoked. Every future action refused. The revocation is permanent and cannot be bypassed by re-registering the same name. Auto-renewal stops. The agent is dead.
What is in the certificate
Every agent cert carries five OID extensions under IANA PEN 66339:
1.3.6.1.4.1.66339.1 Trust level (L0-L4)
1.3.6.1.4.1.66339.2.1 Jurisdiction
1.3.6.1.4.1.66339.3 Capabilities
1.3.6.1.4.1.66339.4 Protocol binding
1.3.6.1.4.1.66339.5 Agent ID
Plus a SPIFFE URI SAN for service mesh compatibility. Standard OpenSSL reads the extensions natively:
openssl x509 -in ~/.agentpass/my-scanner/cert.pem -text -noout | grep -A1 "66339"
It works with any framework
AgentPass is not a framework. It is the identity layer underneath whatever framework you use.
# CrewAI
import agentpass_infer.auto
from crewai import Agent, Task, Crew
# LangChain
import agentpass_infer.auto
from langchain.agents import create_react_agent
# Raw OpenAI SDK
import agentpass_infer.auto
from openai import OpenAI
One import. Every LLM call is now trust-enforced. No other code change.
First independent integration
A developer in Saudi Arabia read the documentation, installed the npm package, and built a working CrewAI security scanner with full MCPS signing and trust enforcement in one afternoon. His words:
"By combining local ECDSA key generation with X.509/SPIFFE identity certificates, AgentPass delivers a robust, zero-trust security gateway for AI agents. Its seamless integration makes verifying agent capabilities, trust levels, and action signatures both cryptographically secure and fully auditable."
-- M. Harris, Senior Software Developer, Saudi Arabia
He did not change his framework. He did not change his model. He installed one package and his agent had an identity.
Certs auto-renew
The MCP server handles renewal silently. At 80% of the certificate TTL it calls the API, gets a fresh cert with the same key pair, saves it to disk. The agent never notices. If the agent is revoked, renewal stops permanently.
Same pattern as SPIFFE SVIDs and Let's Encrypt. Short-lived certs, automatic rotation, zero friction.
Beyond the API
AgentPass is the identity layer. The enforcement stack goes deeper:
AgentPass Mesh -- Kubernetes sidecar. Auto-injected. Three gates (LLM, Database, API). Every call checked before it happens.
helm install agentmesh oci://ghcr.io/razashariff/agentmesh
kubectl label namespace prod agentmesh.io/inject=enabled
AgentPass Inference -- Trust enforcement for any LLM. Ollama, vLLM, OpenAI, Azure. One line.
pip install agentpass-inference
AgentPass OPA -- Drop one Rego policy file into your existing OPA deployment.
agentpass-opa serve --policy policy.json
AgentPass DB -- Per-operation trust enforcement inside PostgreSQL. Verified on live AWS RDS.
SELECT agentpass.set_trust('marketing_bot', 1);
SELECT agentpass.elevate_table('customers', 3);
-- marketing_bot tries DELETE: REFUSED. L1 < L3. Statement never executes.
Try it
Live enforcement demo: agentmesh-demo.fly.dev
Product showcase: showcaseagentpass.fly.dev
Developers: agentpass.co.uk/developers.html
Platform: agentpass.co.uk
Company: cybersecai.co.uk
MCP server: npm install -g @proofxhq/agentpass
Python: pip install agentpass-inference
Kubernetes: helm install agentmesh oci://ghcr.io/razashariff/agentmesh
What this is built on
34 UK patents filed. 14 IETF Internet-Drafts published. IANA Private Enterprise Number 66339. OWASP Agentic Security Top 10 cites this work. Cisco AI Defense implements the MCPS protocol.
Built by CyberSecAI Ltd. BSL 1.1.
Top comments (0)