Agent Trust Protocol™
Check permission before your AI agent uses a tool
Let a permitted tool action run. Block the next one when the policy says stop. ATP Core gives developers policy-evaluation tools and examples of enforcing those decisions immediately before execution.
Start with a local demo, then connect the Hermes tool hook. You can try both without a model API key. The examples have deliberately narrow permissions so you can inspect exactly what runs.
AI agents move between tools, organizations, and protocols. ATP is an open effort to make identity, trust evidence, and privacy controls portable across those boundaries. It complements MCP, A2A, ANP, ADK, and agent frameworks; it does not replace how agents communicate.
Start building: SDK quickstart · Scaffold an agent · Explore packages · Read specification drafts · Contribute
ATP specifications are developed in the W3C Agent Trust Protocol Community Group. Community Group drafts are not endorsed by W3C and are not W3C Standards. Implementation support varies by capability; the repository and package READMEs describe what exists today.
Try it in five minutes
No account, model API key, or hosted ATP service is needed. Use Node.js 20 or 24 and npm for this walkthrough:
git clone https://github.com/agent-trust-protocol/atp-core.git
cd atp-core/examples/action-boundary
npm ci --ignore-scripts
npm start
Only the first callback runs. Read the full walkthrough and text transcript, or try the Hermes hook walkthrough. This demo checks action category and session state; session completion is not mandate revocation.
Protect one tool in Hermes
Already using Hermes Agent? Start with the Hermes walkthrough: allow a read of one fixed file and block terminal, write and patch calls. The hook checks the action before Hermes dispatches the matched tool. To use your own profile, directories and approval mode, install the configurable atp-hermes-hook package.
| Try | What you can verify |
|---|
npm run demo in examples/hermes-hook | Four decisions through the real hook subprocess; Hermes is not started. |
| Run the Hermes runtime verifier | A real Hermes tool read returns the fixture; a denied terminal call creates no sentinel file. Tool selection comes from a scripted local provider. |
| Try it in your own Hermes profile | Check consent and execution in your installed runtime, keeping its native permissions and sandbox. |
Can you withdraw permission? The local demo stops further reads when its session completes. That is not signed-mandate revocation. The Hermes example does not yet implement that revocation path; do not deploy it as a general agent authorization system.
We are looking for five developers to try one protected tool and tell us where setup breaks or the boundary falls short. Join the developer pilot. A failed setup is useful feedback too.
What is here
| Area | Purpose | Current entry point |
|---|
| Identity | did:atp identifiers and hybrid Ed25519/ML-DSA-65 key material | DID package |
| Trust | Evidence, credentials, scoring, and issuer/status work | SDK and drafts |
| Policy | Fail-closed profiles that return allow, require_approval or deny for each action | Profiles |
| Interoperability | Conformance suites and work across agent systems | Conformance runner |
A passing test covers the behavior exercised by that test; it is not certification of every draft feature. Zero-knowledge range claims and some cross-protocol work remain experimental or in development.
Packages
The package READMEs are the source for APIs, limitations, and examples. Install only what your application needs.
| Package | Use it for | Install |
|---|
atp-sdk | Start an agent, use identity and trust utilities, and check actions against a profile | npm install atp-sdk |
create-atp-agent | Scaffold a JavaScript ESM starter | npx create-atp-agent my-agent |
@atpdeveloper/did-atp | Build and inspect canonical did:atp identifier primitives | npm install @atpdeveloper/did-atp |
atp-profiles | Built-in and custom security profiles with a dependency-free evaluator | npm install atp-profiles |
atp-profiles (Python) | The same profiles and fail-closed evaluator for Python agents (LangChain, CrewAI, Hermes plugins) | pip install atp-profiles |
atp-cli | atp in your terminal: guard Claude Code and Hermes tool calls with ATP profiles, a local did:atp identity and a signed audit trail | npm install -g atp-cli (first npm release pending) |
atp-hermes-hook | Enforce an ATP profile and a path scope at Hermes Agent's pre_tool_call boundary |
The OpenClaw adapter (@atpdevelopment/openclaw-atp) is deprecated and archived in archive/openclaw-atp. Use the SDK and canonical packages as the starting point for new integrations; atp-hermes-hook enforces ATP profiles at Hermes Agent's tool boundary.
See a protected action work
Run the local action-boundary demo: a permitted read runs, an approval-required callback stays blocked, and completing the session blocks further reads. It uses the published profile evaluator and needs no hosted ATP service or model API key.
Try the Hermes Agent hook: connect the same published evaluator to Hermes' pre_tool_call boundary, allowing a fixed read while blocking terminal and write tools. The adapter documents its exact scope and Hermes consent setup.
Start with the SDK
atp-sdk 4.0 requires Node.js 20 or newer; its identity code needs Web Crypto, which Node.js 18 does not provide globally. Earlier SDK releases advertised Node.js 18 but failed there in the same way.
npm install atp-sdk
import { Agent } from 'atp-sdk';
const agent = await Agent.quickstart('MyBot');
console.log(agent.getDID());
Then check an action before your agent runs it:
import { BUILTIN_PROFILES, evaluateActionWithProfile } from 'atp-sdk';
const { decision } = evaluateActionWithProfile(BUILTIN_PROFILES['safe-default'], {
actionType: 'shell', // map host tools to categories: terminal → shell, read_file → filesystem
state: 'executing',
});
// 'allow' → run it · 'require_approval' → ask a person first · 'deny' → do not run it
Unrecognized actions, missing actions and missing or misspelled profiles never come back as allow. Your runtime must still enforce the decision.
The standalone quickstart creates local identity material. A local identifier is not automatically publicly resolvable, and this snippet does not configure an issuer, external policy enforcement, or a production key store. See the SDK guide before connecting real services.
Scaffold a project
npx create-atp-agent my-agent
cd my-agent
npm start
The CLI creates a starter and offers a local configuration UI. That UI writes metadata; it does not mint a DID, register an issuer, or enforce the selected profile. The generated agent uses the SDK when it runs. See the CLI guide for terminal-only and existing-project flows.
Explore and test
git clone https://github.com/agent-trust-protocol/atp-core.git
cd atp-core
npm install
npm run conformance
The conformance runner exercises available implementation suites. For a package-specific change, follow that package's README and tests. Do not treat a passing run as a W3C certification or a claim that every draft capability is complete.
Help shape ATP
You can participate without adopting the whole stack:
- Try one package and file a reproducible issue with your Node version and a small example.
- Review a draft and comment on identity, issuer authority, credential status, privacy, or conformance behavior in the Community Group repository.
- Add an interoperability case for an agent system you use, including expected behavior and a test vector where possible.
- Contribute code or docs through a focused pull request. Start with CONTRIBUTING.md.
If ATP is useful to your agent project, star this repository to follow its development. Sharing a reproducible integration or reporting an onboarding problem also helps the project improve.
Issues and pull requests are welcome. Clearly distinguish implemented behavior from draft design and experimental work so other developers can make informed choices.
Project boundaries
This repository is the open ATP Core implementation and developer tooling. The website source is separate. ATP Studio is a separate enterprise product with its own infrastructure and data. Do not put Studio credentials, databases, or deployment configuration in ATP Core.
Agent Trust Protocol™ is a trademark of Sovr Inc. See LICENSE for the repository license and the relevant package license metadata.
