Skip to content

Commit 64acd45

Browse files
Anivar A Aravindclaude
Anivar A Aravind
and
claude
committed
feat: Add AGNTCY Identity support for secure MCP server verification
This commit introduces support for the AGNTCY Identity standard, enabling cryptographically verifiable identities for MCP servers. The implementation provides both development and production modes while maintaining backward compatibility. Key features: - AGNTCY Identity Node client implementation - MCP Server Badge credentials (Verifiable Credentials) - Development mode with local credentials - Production mode with full Identity Node integration - CLI commands for identity management (mcpd identity init/show) - Progressive enhancement - disabled by default - Full AGNTCY v1alpha1 API compliance Configuration example: ```toml [[servers]] name = "secure-server" [servers.identity] enabled = true trusted_issuers = ["did:agntcy:trusted:org"] required_credential_types = ["MCPServerBadge"] ``` This creates a bridge between Mozilla's developer-friendly tools and enterprise-grade identity standards, enabling secure agent-to-agent communication in production environments. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
1 parent 8036a18 commit 64acd45

File tree

14 files changed

+1815
-0
lines changed

14 files changed

+1815
-0
lines changed

‎PROPOSAL_AGNTCY_IDENTITY.md

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
# Proposal: AGNTCY Identity Support for mcpd
2+
3+
## Summary
4+
5+
This proposal introduces AGNTCY Identity standard support to mcpd, enabling cryptographically verifiable identities for MCP servers. This creates a bridge between Mozilla's developer-friendly tools and enterprise-grade security standards.
6+
7+
## Motivation
8+
9+
As AI agents become critical infrastructure, establishing trust and security in agent-to-agent communication is essential. The AGNTCY project (Linux Foundation) is standardizing these interactions. By adopting AGNTCY Identity standards in mcpd, we:
10+
11+
1. **Enable Secure Communication**: MCP servers can verify each other's identities
12+
2. **Build Trust Networks**: Organizations can establish trusted agent ecosystems
13+
3. **Maintain Simplicity**: Progressive enhancement keeps the developer experience simple
14+
4. **Foster Interoperability**: Work with any AGNTCY-compliant system
15+
16+
## Design
17+
18+
### Core Principles
19+
20+
1. **Optional by Default**: Identity features are disabled by default - zero impact on existing users
21+
2. **Progressive Enhancement**: Works locally for development, scales to production
22+
3. **Standards Compliant**: Full compatibility with AGNTCY Identity v1alpha1
23+
4. **Developer First**: Simple commands and configuration
24+
25+
### Implementation Overview
26+
27+
```
28+
# Development - Local identity files
29+
export MCPD_IDENTITY_ENABLED=true
30+
mcpd identity init my-server
31+
mcpd daemon --dev
32+
33+
# Production - AGNTCY Identity Node
34+
export MCPD_IDENTITY_NODE_URL=https://identity.corp.com
35+
mcpd identity init my-server --organization "Corp"
36+
mcpd daemon
37+
```
38+
39+
### Key Features
40+
41+
1. **MCP Server Badges**: Verifiable credentials containing server metadata
42+
2. **Trust Configuration**: Define trusted issuers and required credentials
43+
3. **Development Mode**: Local credentials for testing without infrastructure
44+
4. **Production Mode**: Full integration with AGNTCY Identity Nodes
45+
46+
## Benefits
47+
48+
### For Mozilla
49+
50+
- Positions mcpd as enterprise-ready without sacrificing simplicity
51+
- Creates pathway for adoption in security-conscious organizations
52+
- Demonstrates leadership in AI agent security standards
53+
54+
### For Developers
55+
56+
- Zero-config development with local identities
57+
- Gradual adoption path from development to production
58+
- No changes required for existing workflows
59+
60+
### For Organizations
61+
62+
- Cryptographic verification of agent identities
63+
- Compliance with emerging industry standards
64+
- Interoperability with AGNTCY ecosystem
65+
66+
## Implementation Status
67+
68+
A complete proof-of-concept has been implemented including:
69+
70+
- ✅ AGNTCY Identity Node client
71+
- ✅ Credential generation and verification
72+
- ✅ MCP Server Badge credentials
73+
- ✅ Development and production modes
74+
- ✅ CLI commands for identity management
75+
- ✅ Configuration integration
76+
- ✅ Documentation and examples
77+
78+
## Rollout Plan
79+
80+
### Phase 1: Community Feedback (Current)
81+
- Share proposal with Mozilla AI and AGNTCY communities
82+
- Gather feedback on implementation approach
83+
- Refine based on input
84+
85+
### Phase 2: Experimental Release
86+
- Merge as experimental feature (disabled by default)
87+
- Early adopters test in real environments
88+
- Iterate based on usage patterns
89+
90+
### Phase 3: Stabilization
91+
- Address feedback from early adopters
92+
- Add comprehensive test coverage
93+
- Performance optimization
94+
95+
### Phase 4: General Availability
96+
- Enable by default for new projects
97+
- Migration guide for existing users
98+
- Integration with AGNTCY ecosystem
99+
100+
## Open Questions
101+
102+
1. Should we support additional DID methods beyond AGNTCY's?
103+
2. How should credential refresh be handled automatically?
104+
3. What telemetry would help understand identity usage?
105+
4. Should mcpd run its own Identity Node for development?
106+
107+
## Call to Action
108+
109+
We invite feedback from both communities:
110+
111+
**Mozilla Community**:
112+
- Does this maintain our simplicity principles?
113+
- What concerns do you have about added complexity?
114+
- How can we make this more developer-friendly?
115+
116+
**AGNTCY Community**:
117+
- Does this implementation align with AGNTCY standards?
118+
- What additional features would enhance interoperability?
119+
- How can we collaborate on specifications?
120+
121+
## Next Steps
122+
123+
1. Review and discussion in both communities
124+
2. Refine implementation based on feedback
125+
3. Create comprehensive test suite
126+
4. Submit PR for review
127+
5. Plan experimental release
128+
129+
## References
130+
131+
- [AGNTCY Identity Specification](https://docs.agntcy.org/identity)
132+
- [Implementation Branch](https://github.com/mozilla-ai/mcpd/tree/feat/agntcy-identity-support)
133+
- [Technical Specification](./docs/AGNTCY_IDENTITY_SPEC.md)
134+
- [Example Configuration](./examples/identity-example.toml)
135+
136+
---
137+
138+
**Author**: Anivar Aravind
139+
**Date**: 2025-01-23
140+
**Status**: Proposal
141+
**Discussions**:
142+
- Mozilla AI: [GitHub Discussions](#)
143+
- AGNTCY: [GitHub Discussions](https://github.com/orgs/agntcy/discussions)

‎cmd/identity.go

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
package cmd
2+
3+
import (
4+
"context"
5+
"fmt"
6+
7+
"github.com/spf13/cobra"
8+
9+
"github.com/mozilla-ai/mcpd/v2/internal/config"
10+
"github.com/mozilla-ai/mcpd/v2/internal/identity"
11+
)
12+
13+
// identityCmd represents the identity command group
14+
var identityCmd = &cobra.Command{
15+
Use: "identity",
16+
Short: "Manage AGNTCY identity for MCP servers",
17+
Long: `Identity management commands for AGNTCY-compliant verification.
18+
19+
mcpd supports the AGNTCY Identity standard for secure agent-to-agent communication.
20+
In development mode, identities are stored locally. In production, they integrate
21+
with AGNTCY Identity Nodes.`,
22+
}
23+
24+
// identityInitCmd creates identity credentials for a server
25+
var identityInitCmd = &cobra.Command{
26+
Use: "init [server-name]",
27+
Short: "Initialize identity for an MCP server",
28+
Long: `Create AGNTCY-compliant identity credentials for an MCP server.
29+
30+
In development mode (default), this creates local credentials.
31+
In production mode (with MCPD_IDENTITY_NODE_URL set), this registers
32+
with the AGNTCY Identity Node.`,
33+
Args: cobra.ExactArgs(1),
34+
RunE: func(cmd *cobra.Command, args []string) error {
35+
serverName := args[0]
36+
37+
// Get organization and common name from flags
38+
organization, _ := cmd.Flags().GetString("organization")
39+
commonName, _ := cmd.Flags().GetString("common-name")
40+
authType, _ := cmd.Flags().GetString("auth-type")
41+
42+
// Create issuer
43+
issuer := &identity.Issuer{
44+
Organization: organization,
45+
CommonName: commonName,
46+
AuthType: identity.AuthType(authType),
47+
}
48+
49+
// Initialize identity manager
50+
nodeURL, _ := cmd.Flags().GetString("identity-node-url")
51+
// Use a basic logger for now
52+
manager := identity.NewManager(nil, nodeURL)
53+
54+
if !manager.IsEnabled() {
55+
return fmt.Errorf("identity is not enabled. Set MCPD_IDENTITY_ENABLED=true or provide --identity-node-url")
56+
}
57+
58+
// Generate identity
59+
ctx := context.Background()
60+
cred, err := manager.GenerateServerIdentity(ctx, serverName, issuer)
61+
if err != nil {
62+
return fmt.Errorf("failed to generate identity: %w", err)
63+
}
64+
65+
fmt.Printf("Created identity for server '%s'\n", serverName)
66+
fmt.Printf("DID: %s\n", cred.ResolverMetadata.ID)
67+
fmt.Printf("Credential ID: %s\n", cred.Credential.ID)
68+
69+
return nil
70+
},
71+
}
72+
73+
// identityShowCmd displays identity information for a server
74+
var identityShowCmd = &cobra.Command{
75+
Use: "show [server-name]",
76+
Short: "Show identity credentials for an MCP server",
77+
Args: cobra.ExactArgs(1),
78+
RunE: func(cmd *cobra.Command, args []string) error {
79+
serverName := args[0]
80+
81+
// Initialize identity manager
82+
nodeURL, _ := cmd.Flags().GetString("identity-node-url")
83+
// Use a basic logger for now
84+
manager := identity.NewManager(nil, nodeURL)
85+
86+
if !manager.IsEnabled() {
87+
return fmt.Errorf("identity is not enabled")
88+
}
89+
90+
// Get credentials
91+
credentials, err := manager.GetServerCredentials(serverName)
92+
if err != nil {
93+
return fmt.Errorf("failed to get credentials: %w", err)
94+
}
95+
96+
if len(credentials) == 0 {
97+
fmt.Printf("No identity credentials found for server '%s'\n", serverName)
98+
return nil
99+
}
100+
101+
// Display credentials
102+
for i, cred := range credentials {
103+
fmt.Printf("Credential %d:\n", i+1)
104+
fmt.Printf(" ID: %s\n", cred.ID)
105+
fmt.Printf(" Type: %v\n", cred.Type)
106+
fmt.Printf(" Issuer: %s\n", cred.Issuer)
107+
fmt.Printf(" Issued: %s\n", cred.IssuanceDate)
108+
if cred.ExpirationDate != "" {
109+
fmt.Printf(" Expires: %s\n", cred.ExpirationDate)
110+
}
111+
}
112+
113+
return nil
114+
},
115+
}
116+
117+
func init() {
118+
rootCmd.AddCommand(identityCmd)
119+
identityCmd.AddCommand(identityInitCmd)
120+
identityCmd.AddCommand(identityShowCmd)
121+
122+
// Flags for identity init
123+
identityInitCmd.Flags().String("organization", "Mozilla AI", "Organization name for the issuer")
124+
identityInitCmd.Flags().String("common-name", "mcpd", "Common name for the issuer")
125+
identityInitCmd.Flags().String("auth-type", "SELF", "Authentication type (SELF or IDP)")
126+
identityInitCmd.Flags().String("identity-node-url", "", "AGNTCY Identity Node URL")
127+
128+
// Flags for identity show
129+
identityShowCmd.Flags().String("identity-node-url", "", "AGNTCY Identity Node URL")
130+
131+
// Global identity flags
132+
identityCmd.PersistentFlags().String("identity-node-url", "", "AGNTCY Identity Node URL")
133+
}

0 commit comments

Comments
 (0)