Agent Trust Protocol™

Check permission before your AI agent uses a tool

Let a permitted tool action run. Block the next one when the policy says stop. ATP Core gives developers policy-evaluation tools and examples of enforcing those decisions immediately before execution.

Start with a local demo, then connect the Hermes tool hook. You can try both without a model API key. The examples have deliberately narrow permissions so you can inspect exactly what runs.

AI agents move between tools, organizations, and protocols. ATP is an open effort to make identity, trust evidence, and privacy controls portable across those boundaries. It complements MCP, A2A, ANP, ADK, and agent frameworks; it does not replace how agents communicate.

Start building: SDK quickstart · Scaffold an agent · Explore packages · Read specification drafts · Contribute

ATP specifications are developed in the W3C Agent Trust Protocol Community Group. Community Group drafts are not endorsed by W3C and are not W3C Standards. Implementation support varies by capability; the repository and package READMEs describe what exists today.

Try it in five minutes

No account, model API key, or hosted ATP service is needed. Use Node.js 20 or 24 and npm for this walkthrough:

git clone https://github.com/agent-trust-protocol/atp-core.git
cd atp-core/examples/action-boundary
npm ci --ignore-scripts
npm start

Only the first callback runs. Read the full walkthrough and text transcript, or try the Hermes hook walkthrough. This demo checks action category and session state; session completion is not mandate revocation.

Protect one tool in Hermes

Already using Hermes Agent? Start with the Hermes walkthrough: allow a read of one fixed file and block terminal, write and patch calls. The hook checks the action before Hermes dispatches the matched tool. To use your own profile, directories and approval mode, install the configurable atp-hermes-hook package.

Try	What you can verify
npm run demo in examples/hermes-hook	Four decisions through the real hook subprocess; Hermes is not started.
Run the Hermes runtime verifier	A real Hermes tool read returns the fixture; a denied terminal call creates no sentinel file. Tool selection comes from a scripted local provider.
Try it in your own Hermes profile	Check consent and execution in your installed runtime, keeping its native permissions and sandbox.

Can you withdraw permission? The local demo stops further reads when its session completes. That is not signed-mandate revocation. The Hermes example does not yet implement that revocation path; do not deploy it as a general agent authorization system.

We are looking for five developers to try one protected tool and tell us where setup breaks or the boundary falls short. Join the developer pilot. A failed setup is useful feedback too.

What is here

Area	Purpose	Current entry point
Identity	did:atp identifiers and hybrid Ed25519/ML-DSA-65 key material	DID package
Trust	Evidence, credentials, scoring, and issuer/status work	SDK and drafts
Policy	Fail-closed profiles that return allow, require_approval or deny for each action	Profiles
Interoperability	Conformance suites and work across agent systems	Conformance runner

A passing test covers the behavior exercised by that test; it is not certification of every draft feature. Zero-knowledge range claims and some cross-protocol work remain experimental or in development.

Packages

The package READMEs are the source for APIs, limitations, and examples. Install only what your application needs.

Package	Use it for	Install
atp-sdk	Start an agent, use identity and trust utilities, and check actions against a profile	npm install atp-sdk
create-atp-agent	Scaffold a JavaScript ESM starter	npx create-atp-agent my-agent
@atpdeveloper/did-atp	Build and inspect canonical did:atp identifier primitives	npm install @atpdeveloper/did-atp
atp-profiles	Built-in and custom security profiles with a dependency-free evaluator	npm install atp-profiles
atp-profiles (Python)	The same profiles and fail-closed evaluator for Python agents (LangChain, CrewAI, Hermes plugins)	pip install atp-profiles
atp-cli	atp in your terminal: guard Claude Code and Hermes tool calls with ATP profiles, a local did:atp identity and a signed audit trail	npm install -g atp-cli (first npm release pending)
atp-hermes-hook	Enforce an ATP profile and a path scope at Hermes Agent's pre_tool_call boundary

The OpenClaw adapter (@atpdevelopment/openclaw-atp) is deprecated and archived in archive/openclaw-atp. Use the SDK and canonical packages as the starting point for new integrations; atp-hermes-hook enforces ATP profiles at Hermes Agent's tool boundary.

See a protected action work

Run the local action-boundary demo: a permitted read runs, an approval-required callback stays blocked, and completing the session blocks further reads. It uses the published profile evaluator and needs no hosted ATP service or model API key.

Try the Hermes Agent hook: connect the same published evaluator to Hermes' pre_tool_call boundary, allowing a fixed read while blocking terminal and write tools. The adapter documents its exact scope and Hermes consent setup.

Start with the SDK

atp-sdk 4.0 requires Node.js 20 or newer; its identity code needs Web Crypto, which Node.js 18 does not provide globally. Earlier SDK releases advertised Node.js 18 but failed there in the same way.

npm install atp-sdk

import { Agent } from 'atp-sdk';

const agent = await Agent.quickstart('MyBot');
console.log(agent.getDID());

Then check an action before your agent runs it:

import { BUILTIN_PROFILES, evaluateActionWithProfile } from 'atp-sdk';

const { decision } = evaluateActionWithProfile(BUILTIN_PROFILES['safe-default'], {
  actionType: 'shell', // map host tools to categories: terminal → shell, read_file → filesystem
  state: 'executing',
});
// 'allow' → run it · 'require_approval' → ask a person first · 'deny' → do not run it

Unrecognized actions, missing actions and missing or misspelled profiles never come back as allow. Your runtime must still enforce the decision.

The standalone quickstart creates local identity material. A local identifier is not automatically publicly resolvable, and this snippet does not configure an issuer, external policy enforcement, or a production key store. See the SDK guide before connecting real services.

Scaffold a project

npx create-atp-agent my-agent
cd my-agent
npm start

The CLI creates a starter and offers a local configuration UI. That UI writes metadata; it does not mint a DID, register an issuer, or enforce the selected profile. The generated agent uses the SDK when it runs. See the CLI guide for terminal-only and existing-project flows.

Explore and test

git clone https://github.com/agent-trust-protocol/atp-core.git
cd atp-core
npm install
npm run conformance

The conformance runner exercises available implementation suites. For a package-specific change, follow that package's README and tests. Do not treat a passing run as a W3C certification or a claim that every draft capability is complete.

• Specification drafts
• Community Group discussion
• Public developer website
• Release/versioning policy

Help shape ATP

You can participate without adopting the whole stack:

1. Try one package and file a reproducible issue with your Node version and a small example.
2. Review a draft and comment on identity, issuer authority, credential status, privacy, or conformance behavior in the Community Group repository.
3. Add an interoperability case for an agent system you use, including expected behavior and a test vector where possible.
4. Contribute code or docs through a focused pull request. Start with CONTRIBUTING.md.

If ATP is useful to your agent project, star this repository to follow its development. Sharing a reproducible integration or reporting an onboarding problem also helps the project improve.

Issues and pull requests are welcome. Clearly distinguish implemented behavior from draft design and experimental work so other developers can make informed choices.

Project boundaries

This repository is the open ATP Core implementation and developer tooling. The website source is separate. ATP Studio is a separate enterprise product with its own infrastructure and data. Do not put Studio credentials, databases, or deployment configuration in ATP Core.

Agent Trust Protocol™ is a trademark of Sovr Inc. See LICENSE for the repository license and the relevant package license metadata.