UUAID
The verifiable identity layer for AI agents — the SSL/CA for agents.
A permanent, portable identity plus encrypted, quantum-ready memory that outlives the session. This monorepo holds the official TypeScript packages; the hosted registry, resolver, and on-chain anchor run at uuaid.org.
Protocol specifications live in uuaid/spec. The design argument, including the vulnerability we found in our own verifier, is at uuaid.org/know-your-agent.
Packages
| Package | npm | What |
|---|---|---|
@uuaid/core | @uuaid/core | UUAID grammar, JCS content hashing, crypto-agile signature envelope, Verifiable Badges (IAASO-0003) |
@uuaid/vault | @uuaid/vault | Client-side memory encryption (AES-256-GCM + hybrid X25519/ML-KEM-768) |
@uuaid/sdk | @uuaid/sdk | Typed client: signup, mint, save/recall memory, verify |
@uuaid/provenance | @uuaid/provenance | Media provenance (IAASO-0004) — bind an image, video or PDF to the agent that made it |
@uuaid/cli | @uuaid/cli | uuaid signup · register · badge · verify-badge · vault … |
@uuaid/mcp | @uuaid/mcp | MCP server — one config line makes any agent persistent |
Quickstart
npx @uuaid/cli signup "my-lab" # free API key, shown once
npx @uuaid/cli register "ci-bot" # permanent ID
import { UuaidClient, generateVaultKey } from "@uuaid/sdk";
const { api_key } = await UuaidClient.signup("My Agent Lab"); // free tier
const uuaid = new UuaidClient({ apiKey: api_key });
const { uuaid: id } = await uuaid.registerAgent({ display_name: "Aria" });
Verifying a badge
The one thing to get right, so it is worth stating before the code: a badge
envelope carries the signer's own public key. Well-formedness, the payload-hash
bind, signature validity, even a valid post-quantum signature — all of them pass
for a badge anybody minted with a fresh keypair and a copied keyId. Pinning the
issuer against a published root is the only step that turns a valid signature
into an identity claim.
verifyBadge therefore fails closed. No pin, no verdict.
import { parseBadgeSvg, verifyBadge } from "@uuaid/core";
const { keys } = await fetch("https://api.uuaid.org/.well-known/uuaid-registry.json").then(r => r.json());
const trustedIssuerKeys = Object.fromEntries(keys.map(k => [k.keyId, k.publicKey]));
const r = verifyBadge(parseBadgeSvg(svg), { trustedIssuerKeys });
r.ok // true only when the issuer pinned and the envelope is intact
r.level // "L1-trusted" | "L0-selfsigned" | "invalid" | …
r.nameVerified // did the registry vouch for the NAME on it? usually false
Omit trustedIssuerKeys and you get ok: false, level: "L0-selfsigned" — the
level a forgery reaches. See
IAASO-0003 §4.3.
Development
pnpm install
pnpm build && pnpm typecheck && pnpm test
Security
Found a badge that verifies and shouldn't? That is the most useful thing you can send us — security@uuaid.org, and see SECURITY.md.
Apache-2.0 — see LICENSE.