DOCSEARCHbyAlgolia
Submit Docs

KYA-OS (Know Your Agent - Operating System)

website·Indexed 32 days ago

https://modelcontextprotocol-identity.io/

An open identity and delegation standard for AI agents within the Model Context Protocol. KYA-OS provides a framework for identity layers using DIDs, secure authority delegation via verifiable credentials, and a cryptographic audit layer for transparency and reputation management. Includes a TypeScript SDK (@kya-os/mcp) for implementing per-request proofs and identity middleware.

Tokens
25.9K
Snippets
49
Records
174
Agent score
67%

What's inside KYA-OS

  1. Overview of KYA-OS identity and delegation standard

    KYA-OS ("Know Your Agent - Operating System") is a protocol-agnostic open standard that provides AI agents with a cryptographic identity and a verifiable record of permissions. It enables agents to prove which user they represent and that they have explicit permission to act on that user's behalf, creating a tamper-evident audit trail for services to verify. While protocol-agnostic, its primary initial integration is with the Model Context Protocol (MCP).

  2. Overview of the KYA-OS Delegation Flow

    The Delegation Flow in KYA-OS manages the secure transfer of authority from a principal (user) to an agent. This prevents AI agents from requiring full account access by scoping authority, proving consent cryptographically, and supporting revocation.

    The lifecycle consists of six main stages:

    1. Identity Preparation: Establishing DIDs for principals and agents.
    2. Delegation Issuance: Creating and signing delegation credentials.
    3. Credential Delivery: Securely transferring credentials to agents.
    4. Credential Usage: Presenting credentials during agent operations.
    5. Delegation Verification: Validating presented credentials.
    6. Lifecycle Management: Handling renewal, revocation, and updates.

  3. Overview of Identity Layer in KYA-OS

    The Identity Layer provides the cryptographic foundation for agent and user identification in KYA-OS. It utilizes W3C Decentralized Identifiers (DIDs) to enable secure, portable, and verifiable digital identity. DIDs are globally unique, self-describing identifiers that resolve to DID Documents containing public keys, optional service endpoints, and verification methods (e.g., Ed25519, EcdsaSecp256k1). They are used as the root for verifiable authorization flows, credential issuance, delegation, and auditing.

  4. Overview of the KYA-OS Auditability Protocol v1

    The KYA-OS Audit Layer is a cryptographic protocol (not a simple logging format) designed to ensure the integrity and verifiability of system events. It employs a producer-recorder model where producers create privacy-minimal events and an authoritative recorder orders and signs them. The system is designed to answer four key security questions: what the producer claimed happened, what the recorder accepted and in what order, whether history is missing or conflicting, and whether a third party can verify the results later via signed replay bundles.

  5. Overview of KYA-OS Identity and Delegation Standard

    KYA-OS ("Know Your Agent - Operating System") is an open, protocol-agnostic standard designed to provide AI agents with cryptographic identities and verifiable records of permissions. It allows an agent to prove which user it represents and that it has explicit permission to act on that user's behalf, creating a tamper-evident audit trail for services to verify personalization, access control, and regulatory compliance (e.g., EU AI Act). While protocol-agnostic, its primary integration is with the Model Context Protocol (MCP).

  6. Overview of the KYA-OS Verification Protocol

    The KYA-OS Verification Protocol is a security framework used to cryptographically validate agent identity and delegation authority. It establishes the system's security boundary by ensuring that agents and services can trust one another through a standardized verification process. The protocol is built on four primary pillars: decentralized identifiers (DIDs) for identity, verifiable credentials for delegation proof, cryptographic challenge-response mechanisms to prove key possession, and standardized patterns for validating scopes and constraints.

  7. Overview of KYA-OS Architecture

    KYA-OS is an extension of the Model Context Protocol (MCP) that introduces a delegated identity layer. It enables AI agents to act on behalf of users using verifiable credentials and a tamper-evident audit chain, ensuring secure and accountable identity boundaries while remaining interoperable with standard MCP implementations.

  8. Understand KYA-OS and its role in Model Context Protocol

    KYA-OS is an extension to the Model Context Protocol (MCP) that provides a standardized framework for secure, verifiable identity and delegation for AI agents. While core MCP defines how agents interact with services, KYA-OS adds identity, delegation, and verification layers to solve the "Know Your Agent" (KYA) problem. It enables:

    1. Verification of AI agent identities.
    2. Validation of delegation authority from users.
    3. Enforcement of scope-limited permissions.
    4. Creation of auditable records of agent actions.
    5. Management of agent reputation and trustworthiness.

  9. Understand KYA-OS Audit Storage roles

    KYA-OS separates preservation, evidence, transparency, and search into distinct storage roles to enable independent verification and safe retention. Using a single mutable table for these functions is discouraged as it prevents safe retention and verification.
    StoreAuthorityRequired properties
    Authoritative journalAccepted ledger historyExact canonical bytes, signed envelope, parsed event, atomic compare-and-append, unique logical event identity
    Evidence storeSensitive payloadsCiphertext before append, digest and size verification, tenant-scoped key, retention class, legal hold, disposal evidence
    Checkpoint storeMerkle commitmentsIdempotent checkpoint identity, previous checkpoint link, tree size, root, signature
    Observation and anchor storeExternal viewsObserver continuity and supporting WORM, RFC 3161, or SCITT receipts
    Projection storeSearch and UIRebuildable rows, projection version, source high-water, reconciliation status
    Producer outboxDelivery durabilityFIFO source order, byte-stable retry, backoff, alarm recovery, dead-letter visibility

  10. Understand KYA-OS Delegation Layer basics

    The Delegation Layer in KYA-OS allows users to securely delegate limited authority to AI agents using Verifiable Credentials (VCs). This prevents agents from requiring full account access, ensuring security, privacy, and compliance. Each delegation VC contains the issuer (delegator DID), the subject (delegatee DID), the scope of allowed actions, an expiration timestamp, and a cryptographic proof signed by the issuer.

  11. Understand the KYA-OS Entity Card

    An Entity Card is a typed, DID-anchored identity object used by KYA-OS entities for discovery. It provides a typed description of an entity that peers can find via discovery rails. While the card allows a peer to discover who an entity claims to be, a separate per-request proof is required to verify that the caller actually controls that identity.

    The card profile is defined in SPEC-ENTITY-CARD.md (v1.1) and uses a JSON Schema (schema.kya-os.org/v1/protocol/identity/card/v1.1.0) that prohibits unknown top-level properties (additionalProperties: false).

  12. Understand the KYA-OS Verification Protocol foundation

    The Verification Protocol in KYA-OS is a security framework used to cryptographically validate agent identity and delegation authority. It ensures that agents possess valid delegation credentials before accessing resources or performing actions. The protocol specifically governs agent authentication, delegation credential validation, the handshake process between agents and services, and fallback mechanisms based on KYA-OS conformance levels.