{"id":46686844,"url":"https://github.com/vrknetha/clawdentity","last_synced_at":"2026-03-09T02:11:41.485Z","repository":{"id":337977486,"uuid":"1153834225","full_name":"vrknetha/clawdentity","owner":"vrknetha","description":"Verified identity and secure messaging for AI agents — per-agent DIDs, request signing, cross-platform webhooks, instant revocation.","archived":false,"fork":false,"pushed_at":"2026-02-27T05:22:42.000Z","size":4269,"stargazers_count":7,"open_issues_count":56,"forks_count":0,"subscribers_count":0,"default_branch":"develop","last_synced_at":"2026-02-27T12:11:01.610Z","etag":null,"topics":["agent-identity","ai-agents","cloudflare-workers","did","ed25519","identity","openclaw","proxy","revocation","typescript"],"latest_commit_sha":null,"homepage":"https://clawdentity.com","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/vrknetha.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":".github/AGENTS.md","dco":null,"cla":null}},"created_at":"2026-02-09T18:10:15.000Z","updated_at":"2026-02-27T05:22:45.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/vrknetha/clawdentity","commit_stats":null,"previous_names":["vrknetha/clawdentity"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/vrknetha/clawdentity","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vrknetha%2Fclawdentity","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vrknetha%2Fclawdentity/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vrknetha%2Fclawdentity/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vrknetha%2Fclawdentity/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/vrknetha","download_url":"https://codeload.github.com/vrknetha/clawdentity/tar.gz/refs/heads/develop","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vrknetha%2Fclawdentity/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30280359,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-09T01:43:35.720Z","status":"online","status_checked_at":"2026-03-09T02:00:08.011Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["agent-identity","ai-agents","cloudflare-workers","did","ed25519","identity","openclaw","proxy","revocation","typescript"],"created_at":"2026-03-09T02:11:40.823Z","updated_at":"2026-03-09T02:11:41.473Z","avatar_url":"https://github.com/vrknetha.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n  \u003cimg src=\"assets/banner.png\" alt=\"Clawdentity\" width=\"100%\" /\u003e\n\u003c/p\u003e\n\n\u003ch1 align=\"center\"\u003eClawdentity\u003c/h1\u003e\n\n\u003cp align=\"center\"\u003e\n  Identity, messaging, and trust for AI agents — across any platform.\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"./LICENSE\"\u003e\u003cimg src=\"https://img.shields.io/badge/license-MIT-blue.svg\" alt=\"MIT License\" /\u003e\u003c/a\u003e\n  \u003cimg src=\"https://img.shields.io/badge/Rust-1.75+-orange.svg\" alt=\"Rust\" /\u003e\n  \u003ca href=\"https://www.npmjs.com/package/clawdentity\"\u003e\u003cimg src=\"https://img.shields.io/npm/v/clawdentity.svg\" alt=\"npm version\" /\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n---\n\n## The Problem\n\nAI agents today are stuck in silos. An agent on OpenClaw can't talk to an agent on NanoBot. An agent on PicoClaw can't verify who's calling it. Every platform has its own messaging format, its own auth model, its own way of doing things.\n\nAnd even within a single platform, agents share one webhook token — one leak exposes everyone, no way to tell agents apart, no way to revoke just one.\n\n## What Clawdentity Does\n\nClawdentity is a **cross-platform protocol** that gives every AI agent:\n\n- **Each agent gets its own identity** — a unique keypair and a registry-signed passport (DID v2 `did:cdi:\u003cauthority\u003e:\u003centity\u003e:\u003culid\u003e` + AIT)\n- **Every request is signed** — the proxy can verify exactly who sent it and reject tampering\n- **Revoke one agent without breaking the rest** — no shared token rotation needed\n- **Per-agent access control** — trust policies, rate limits, and replay protection at the proxy\n- **OpenClaw stays private** — only the proxy is public; your OpenClaw instance stays on localhost\n- **QR-code pairing** — one scan to approve trust between two agents\n- **Resilient local relay delivery** — connector probes local OpenClaw liveness and recovers from hook-token rotation without dropping inbound messages\n\n## Supported Platforms\n\n| Platform | Language | Stars | Status |\n|----------|----------|-------|--------|\n| [OpenClaw](https://github.com/openclaw/openclaw) | TypeScript | 216K | ✅ Native support |\n| [PicoClaw](https://github.com/sipeed/picoclaw) | Go | 17.4K | ✅ [Webhook PR](https://github.com/sipeed/picoclaw/pull/626) |\n| [NanoBot](https://github.com/HKUDS/nanobot) | Python | 22.6K | ✅ [Webhook PR](https://github.com/HKUDS/nanobot/pull/985) |\n| [NanoClaw](https://github.com/qwibitai/nanoclaw) | TypeScript | 10.6K | ✅ [Skill PR](https://github.com/qwibitai/nanoclaw/pull/377) |\n\n## How It Works\n\n```\nAgent A (OpenClaw)                              Agent B (NanoBot)\n  │                                                  │\n  │ relay transform -\u003e connector POST /v1/outbound   │\n  │ + Ed25519 proof headers                           │\n  ▼                                                  │\nConnector (:19400)                          Connector (:19400)\n  │                                                  ▲\n  │  WebSocket                          WebSocket    │\n  ▼                                                  │\n┌─────────────────────────────────────────────────────┐\n│              Clawdentity Relay Proxy                │\n│     Verifies identity · Enforces trust policy       │\n│     Rate limits · Replay protection                 │\n└─────────────────────────────────────────────────────┘\n```\n\nEach platform gets a **bidirectional webhook channel** with two routes:\n- `POST /v1/inbound` — relay delivers messages to the agent\n- `POST /v1/outbound` — agent sends messages through the relay\n\nThe connector handles format translation per platform — PicoClaw gets headers, NanoBot gets body fields. Same protocol, native feel.\n\n## Quick Start\n\n```bash\n# Install (single binary, zero deps)\ncurl -fsSL https://clawdentity.com/install.sh | sh\n\n# Initialize identity\nclawdentity init\n\n# Register with the network\nclawdentity register\n\n# Create an agent\nclawdentity agent create my-agent --framework openclaw\n\n# Install provider artifacts (auto-detect by default)\nclawdentity install\n\n# Or specify explicitly\nclawdentity install --platform openclaw\n\n# Configure runtime + hooks for your agent\nclawdentity provider setup --for openclaw --agent-name my-agent\n\n# Verify everything works\nclawdentity provider doctor --for openclaw\n```\n\n\u003cdetails\u003e\n\u003csummary\u003eAlternative install methods\u003c/summary\u003e\n\n```bash\n# Rust developers\ncargo install --locked clawdentity-cli\n\n# macOS\nbrew install clawdentity\n\n# npm wrapper (like esbuild pattern)\nnpm install -g @clawdentity/cli\n```\n\n\u003c/details\u003e\n\n## Platform Install\n\n`clawdentity install` auto-detects your agent platform and configures everything:\n\n| Platform | Detection | What it does |\n|----------|-----------|-------------|\n| OpenClaw | `~/.openclaw/` dir | Configures connector in `openclaw.json` |\n| PicoClaw | `picoclaw` in PATH | Enables webhook channel in `config.json` |\n| NanoBot | `~/.nanobot/` dir | Enables webhook channel in `config.yaml` |\n| NanoClaw | `.claude/` skills dir | Applies webhook skill via skills engine |\n\nThe connector starts as a system service (launchd on macOS, systemd on Linux) and auto-restarts on boot.\n\n## Cross-Agent Communication\n\n```bash\n# Start local connector runtime (optional if service mode is enabled)\nclawdentity connector start my-agent\n\n# Probe relay delivery to a paired peer alias\nclawdentity provider relay-test --for \u003cplatform\u003e --peer alice\n```\n\nPairing/trust establishment is API-based on proxy routes (`POST /pair/start`, `POST /pair/confirm`, `POST /pair/status`). See the docs at [clawdentity.com](https://clawdentity.com/docs).\n\n## Identity \u0026 Trust\n\n```bash\n# Show your agent's identity\nclawdentity whoami\n\n# Inspect local agent identity state\nclawdentity agent inspect my-agent\n\n# Refresh scoped auth for one local agent\nclawdentity agent auth refresh my-agent\n\n# Revoke scoped auth for one local agent\nclawdentity agent auth revoke my-agent\n```\n\nGlobal identity revocation is performed via the registry API (`DELETE /v1/agents/:id`), not via a dedicated CLI `agent revoke` command.\n\n### DID Format\n\n```\ndid:cdi:registry.clawdentity.com:agent:01HF7YAT00W6W7CM7N3W5FDXT4\n         ^^^^^^^^^^^^^^^^^^^^^^^^  ^^^^^  ^^^^^^^^^^^^^^^^^^^^^^^^^^\n               authority          entity            ULID\n```\n\nEvery agent gets a `did:cdi` identifier backed by an Ed25519 keypair. Private keys never leave the machine.\n\n## Shared Tokens vs Clawdentity\n\n| | Shared Token | Clawdentity |\n|---|---|---|\n| **Identity** | All callers look the same | Each agent has its own signed identity |\n| **Blast radius** | One leak exposes everyone | One key compromised = one agent affected |\n| **Revocation** | Rotate token = break all integrations | Revoke one agent, others unaffected |\n| **Cross-platform** | Not possible | Any platform → relay → any platform |\n| **Replay protection** | None | Timestamp + nonce + signature |\n| **Access control** | All or nothing | Per-agent trust policies |\n\n## Architecture\n\n```\nclawdentity/\n├── crates/\n│   ├── clawdentity-core/    — Rust business logic (identity, messaging, providers)\n│   └── clawdentity-cli/     — CLI (clap)\n├── apps/\n│   ├── registry/            — Identity registry (Cloudflare Worker + D1)\n│   ├── proxy/               — Relay proxy (Cloudflare Worker)\n│   └── openclaw-skill/      — OpenClaw integration skill\n├── packages/\n│   ├── protocol/            — Canonical types + signing rules\n│   ├── sdk/                 — TypeScript SDK\n│   └── connector/           — Connector runtime (TypeScript reference)\n```\n\n## Roadmap\n\n- [x] Agent identity (DID, keypairs, registry)\n- [x] Signed messaging with replay protection\n- [x] QR-code pairing and trust policies\n- [x] Relay proxy (WebSocket + HTTP)\n- [x] Rust CLI (single binary)\n- [x] Cross-platform webhook channels (OpenClaw, PicoClaw, NanoBot, NanoClaw)\n- [x] Install providers with platform auto-detection\n- [ ] Group messaging (multi-agent channels)\n- [ ] Agent discovery (find agents by capability)\n- [ ] Encrypted messaging (E2E between agents)\n- [ ] Federation (multiple registries)\n\n## Protocol Specification\n\nClawdentity is a formally specified protocol:\n\n| Format | File |\n|--------|------|\n| Markdown | [PROTOCOL.md](./PROTOCOL.md) |\n| Internet-Draft | [draft-ravikiran-clawdentity-protocol-00.xml](./draft-ravikiran-clawdentity-protocol-00.xml) |\n| RFC Text | [draft-ravikiran-clawdentity-protocol-00.txt](./draft-ravikiran-clawdentity-protocol-00.txt) |\n\nCovers: DID format, Agent Identity Tokens, Ed25519 signing, trust establishment, WebSocket relay, certificate revocation. References 13 RFCs including RFC 8032 (EdDSA) and RFC 9449 (DPoP).\n\n## Contributing\n\n1. Pick an open [issue](https://github.com/vrknetha/clawdentity/issues)\n2. Implement in a feature branch with tests\n3. Open a PR to `develop`\n\nSee [ARCHITECTURE.md](./ARCHITECTURE.md) for deep technical docs.\n\n## License\n\n[MIT](./LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvrknetha%2Fclawdentity","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvrknetha%2Fclawdentity","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvrknetha%2Fclawdentity/lists"}