Identity
Every agent gets an Ed25519 keypair and an AIP identifier. DNS-based or self-certifying. No certificate authority needed.
OPEN-SOURCE PROTOCOL · IETF DRAFT-PRAKASH-AIP
One token answers five questions: who authorized this, through which agents the delegation flowed, what scope applied at each hop, what happened, and whether it was independently verified.
// scope narrows at each hop · chain verifies in 0.049 ms
The auth gap
A scan of approximately 2,000 MCP servers found zero authentication. MCP recently added OAuth 2.1, but it covers only single-hop auth: when an orchestrator delegates to a specialist that calls a tool, the delegation chain disappears.
A2A is worse. Agent identities are self-declared strings in aip_identity fields with no cryptographic attestation. Any agent can claim to be any other agent.
The fix
AIP gives every agent a cryptographic identity. Three ways to adopt, smallest change first:
pip install aip-agents[crewai]# python
from aip_agents.adapters.crewai import CrewAIPlugin
plugin = CrewAIPlugin(app_name="my-app")
plugin.setup(crew) # every agent gets a cryptographic identity
headers = plugin.get_auth_headers("researcher")
# python
from aip_agents.adapters.adk import ADKPlugin
plugin = ADKPlugin(app_name="my-app")
plugin.setup(root_agent)
headers = plugin.get_auth_headers("specialist")
# python
from aip_agents.adapters.langchain import LangChainPlugin
plugin = LangChainPlugin(app_name="my-app")
plugin.register(executor, name="researcher")
headers = plugin.get_auth_headers("researcher")
// typescript
import { AIPLangChainPlugin } from "@aip-sdk/agents";
const plugin = new AIPLangChainPlugin();
await plugin.register(agentExecutor, "search-agent");
const headers = await plugin.getToolCallHeaders("search-agent");
# python (core SDK)
from aip_core.crypto import KeyPair
from aip_token.claims import AipClaims
from aip_token.compact import CompactToken
import time
kp = KeyPair.generate()
claims = AipClaims(
iss="aip:key:ed25519:" + kp.public_key_multibase(),
sub="aip:web:example.com/tools/search",
scope=["tool:search"],
budget_usd=1.0, max_depth=0,
iat=int(time.time()), exp=int(time.time()) + 3600,
)
token = CompactToken.create(claims, kp)
headers = {"X-AIP-Token": token}
Four pillars
Every agent gets an Ed25519 keypair and an AIP identifier. DNS-based or self-certifying. No certificate authority needed.
Append-only Biscuit chain. Bounded depth. Every hop signs its delegation and records a mandatory context string.
Datalog policies in three profiles (Simple / Standard / Advanced). Holder-side attenuation: scope only narrows, never widens.
Completion blocks record outcome, cost, and verification status. The completed token answers who, through whom, with what scope, and what happened.
Also: two token modes (compact / chained), MCP and A2A protocol bindings, structured error codes, key rotation via overlapping validity windows.
How delegation works
Each hop appends a new Biscuit block that can only narrow the scope of the previous block. The token is append-only: you add restrictions, never remove them. If any block is tampered with, the entire chain is rejected.
Works with
Guides
Zero to working auth in five minutes. Install, generate keys, secure your agents.
Get started →Add cryptographic identity to your CrewAI agents and crews.
Read guide →Identity and delegation for ADK agent hierarchies.
Read guide →Secure LangChain executors and multi-agent supervisors.
Read guide →Cryptographic identity and delegation for agent-to-agent calls.
Read guide →Drop-in auth for any MCP server. Zero code changes.
Read guide →Multi-agent delegation, scope attenuation, and chain verification.
Read guide →See also: Specification · Interactive Paper
Research
The protocol design, experiments, and adversarial evaluation are described in the AIP paper. AIP is part of a multi-agent trust stack with three companion papers.
0.049 ms verification in Rust. 0.086% overhead in real LLM multi-agent chains. 100% rejection across 600 / 600 adversarial attacks in 6 categories.