What is AgentTag?
AgentTag is a control plane that gives every autonomous AI agent its own cryptographic identity (an Ed25519 keypair bound to a W3C DID), a signed mandate that defines what it is permitted to do, and a tamper-evident hash-chained audit ledger of every action it takes — so teams can deploy agents in production without losing visibility or control.
Instead of giving agents shared API keys, AgentTag gives each agent a distinct, revocable identity. Access can be scoped to specific tools, capped at a spend limit, and cut off in a single step — with a signed audit trail proving what happened.
The problem: why AI agents need their own identity
Today, giving an AI agent access to a system means one of two things: handing it a human's API key, or injecting credentials into the agent's environment. Both approaches have the same three failure modes:
No scope
An agent given a human's key can do everything that human can do. There is no way to say "this agent may only read, not write" or "this agent's spend is capped at $50."
No attribution
When an agent acts with a shared key, the logs say the human did it. You cannot distinguish which agent took an action from the audit trail.
No clean revocation
Revoking a compromised agent means rotating credentials that every other agent and system depends on. There is no targeted revocation.
AgentTag is built on the opposite principle: delegation, not impersonation. Each agent has its own identity. The human doesn't lend the agent a borrowed key — the human signs a mandate granting specific, bounded authority.
How AgentTag works
AgentTag is composed of three primitives that work together: an identity layer, a policy layer, and an audit layer.
- 1
Mint an agent passport
Run `agenttag mcp add --client claude`. The CLI generates an Ed25519 keypair and binds it to a W3C DID — the agent's permanent cryptographic identity. The private key is stored in an isolated vault; it never appears in logs or environment variables.
Ed25519W3C DID< 1 min - 2
Issue a signed mandate
Define what the agent is allowed to do in a mandate: which MCP tools it may call, its spend cap, which actions require step-up approval, and when the mandate expires. The mandate is cryptographically signed by the operator and evaluated at request time — not at agent startup.
Policy-as-codeRuntime enforcementRevocable - 3
Every action is recorded
When the agent acts, the action is signed with its passport and appended to the audit ledger. Each entry includes the SHA-256 hash of the previous entry — making the chain tamper-evident. Any retroactive edit breaks every subsequent hash.
SHA-256Hash-chainedExportable - 4
Revoke or re-scope instantly
If an agent is compromised or a mandate needs to be updated, revoke it from the control plane or via CLI. The change takes effect on the next request — no credential rotation, no system restart, no blast radius beyond the single agent.
Instant revocationNo restartBounded blast radius
Who is AgentTag for?
AgentTag is for any team that deploys autonomous AI agents with access to real systems. Specifically:
Engineering & platform teams
Teams shipping multi-agent pipelines to production who need audit trails, access controls, and revocation without rebuilding authentication from scratch.
Security & compliance teams
Teams that need to answer "what did that agent do, and who authorised it?" — with cryptographic proof, not just application logs.
AI / LLM developers
Developers building on Claude Desktop, CrewAI, LangChain, or custom MCP stacks who want to give their agents least-privilege access to tools and APIs.
Enterprise operators
Organisations deploying agent fleets that need OIDC federation, region-scoped data residency, and a tamper-evident ledger they can export and verify independently.
AgentTag works with any MCP-compatible client or A2A agent runtime — Claude Desktop, CrewAI, LangChain, and custom stacks — without changes to existing clients. See also: how AgentTag secures agents · common questions.
Frequently asked questions about AgentTag
What is AgentTag?
+
AgentTag is a control plane for AI agent identity and governance. It gives every autonomous AI agent its own cryptographic keypair (Ed25519), a W3C DID-based identity, a signed mandate defining what it is permitted to do, and a tamper-evident hash-chained audit ledger of every action it takes.
What problem does AgentTag solve?
+
Most teams give AI agents access by sharing human API keys or environment variables. This means the agent can do anything the human can do, there's no audit trail attributable to the agent specifically, and revoking access means rotating credentials other systems depend on. AgentTag solves this by giving each agent its own distinct cryptographic identity with scoped, revocable permissions.
How is AgentTag different from giving an AI agent my API keys?
+
API keys give an agent broad, unscoped access. AgentTag gives each agent a separate cryptographic identity with a signed mandate specifying exactly which tools it can use, spend limits, human-approval triggers, and expiry. Every action is recorded in a tamper-evident audit ledger.
What is an agent passport?
+
An agent passport is an Ed25519 keypair bound to a W3C DID that belongs exclusively to one agent. The private key never leaves the agent runtime. Every request the agent makes is signed with this key, creating verifiable attribution from each action back to the specific agent.
Which AI frameworks does AgentTag work with?
+
AgentTag works with any MCP-compatible client or A2A runtime: Claude Desktop, CrewAI, LangChain, and custom MCP stacks. It sits in front of your existing MCP servers — your clients continue to work unchanged.
Is AgentTag free?
+
Yes — free during the public beta with generous limits. Founding users lock in pricing when paid plans launch. You will get at least 30 days' notice before the beta ends.
How do I install AgentTag?
+
Run `agenttag mcp add --client claude` to mint your first agent passport and register a mandate. Setup takes under five minutes.
Start governing your agents today
AgentTag is free during the public beta. Add it to any MCP-compatible agent in under five minutes — no infrastructure changes required.