{
  "markdown": "# 🏗️ Wallet4Agent — Technical Stack Overview  \n### **For developers building trusted AI Agents able to interact with persons, companies, services, and other agents**  \n\nWallet4Agent provides the **trust layer** that AI Agents need to operate safely in the real world.  \nThis document explains the technical components, standards, and identity mechanisms behind the platform.\n\n---\n\n# 1. 🎯 Purpose of Wallet4Agent\n\nAI Agents increasingly take actions, access data, and collaborate.  \nTo do this safely, they must be able to:\n\n- 🆔 Prove **who they are**\n- 👤 Prove **who owns or controls them**\n- 📄 Hold **verifiable credentials**\n- 🔐 Sign actions and data securely\n- 🔗 Trust **users**, **companies**, and **other agents**\n- 🪪 Authenticate to external systems without fragile API keys\n\nWallet4Agent provides AI Agents with:\n\n- **A DID-based identity**\n- **A secure wallet for credentials**\n- **Cloud KMS-backed signing keys**\n- **Interoperability with OIDC4VCI, OIDC4VP, SD‑JWT, JSON-LD, OAuth2**\n- **An MCP server interface for agents**\n\nEverything is standards‑based and interoperable.\n\n---\n\n# 2. 🧱 Architecture Overview\n\nWallet4Agent is built with three coordinated layers:\n\n## 2.1 🖥️ MCP Server (Model Context Protocol)\n- Single endpoint:  \n  `POST https://wallet4agent.com/mcp`\n- Exposes all operations as **tools**:\n  - Identity creation\n  - Credential issuance\n  - Verification flows\n  - Signing operations\n  - Configuration\n\n## 2.2 👛 Identity Wallet\nManages:\n\n- The Agent’s DID & DID Document  \n- Stored credentials (SD‑JWT VC, VC JSON‑LD)  \n- Linked Verifiable Presentations  \n- Wallet metadata & service endpoints  \n\n## 2.3 🔐 Authorization & Verification Layer\nSupports:\n\n- OAuth2 access tokens\n- OIDC4VCI (credential issuance)\n- OIDC4VP (presentation)\n- User verification flows\n- Agent‑to‑Agent authentication\n\nAll complex cryptographic and identity logic stays in Wallet4Agent.  \nYour agent simply calls MCP tools.\n\n---\n\n# 3. 🆔 Identity Layer (DID & DID Documents)\n\nEach AI Agent receives a **Decentralized Identifier (DID)** compliant with the W3C DID Core specification.\n\nWallet4Agent supports **two DID methods**:\n\n---\n\n## **3.1 🌐 did:web (DNS-based identity)**  \nA DID anchored on a domain.\n\n```\ndid:web:wallet4agent.com:<agent-id>\n```\n\n⭐ Characteristics:\n\n- Easy to resolve using HTTPS  \n- DID Document lives at:  \n  `https://wallet4agent.com/did/<agent-id>`  \n- Perfect for SaaS agents  \n- Human-readable, infrastructure-friendly  \n- Works well for corporate or platform-linked AI agents  \n\n🔗 DID:web specification:  \nhttps://www.w3.org/TR/did-spec-registries/#did-method-web\n\n---\n\n## **3.2 ⛓️ did:cheqd (ledger-based identity)**  \nA DID anchored on the **Cheqd decentralized ledger**.\n\n```\ndid:cheqd:<network>:<identifier>\n```\n\n⭐ Characteristics:\n\n- Tamper-resistant DID Document stored on-ledger  \n- Supports **ledger-anchored keys**, rotations, service endpoints  \n- Ideal for:\n  - High-assurance identity\n  - Regulated environments\n  - Trust registries\n  - Decentralized compliance ecosystems  \n\n🔗 DID:cheqd specification:  \nhttps://docs.cheqd.io/identity/\n\n---\n\n# 4. 📄 DID Documents\n\nRegardless of DID method, the DID Document exposes:\n\n- 🔑 Public keys  \n- 🔐 Authentication methods  \n- 📌 Service endpoints  \n- 🧾 Linked Verifiable Presentations  \n- 🧬 Key types (JWK, Ed25519, etc.)  \n\nDID Documents are **automatically updated** when:\n\n- Keys rotate  \n- New developer or agent keys are registered  \n- Credentials are published as Linked VPs  \n- Authentication methods change  \n\nExternal agents and services use the DID Document to verify signatures, credentials, and linked proofs.\n\n---\n\n# 5. 🔗 Linked Verifiable Presentations (Linked VP)\n\nLinked VP allows Wallet4Agent to **publish verifiable credentials inside the DID Document** as references.\n\nWhy this matters:\n\n- Public credentials become discoverable  \n- Third parties can verify agent capabilities  \n- Useful for:\n  - Corporate mandates\n  - Agent capabilities\n  - Service trust signals\n  - Compliance proofs  \n\nSupported formats:\n\n- 🟦 SD‑JWT VC  \n- 🟩 JWT‑VC / JWT‑VP  \n- 🟪 JSON‑LD VC / VP  \n\nSpecification:  \nhttps://identity.foundation/linked-vp/spec/v1.0.0/\n\n---\n\n# 6. 🔐 Cryptography & Key Management\n\n## 6.1 🗝️ Cloud KMS–backed keys (non-exportable)\nEach agent has a dedicated **cloud KMS key**.\n\nUsed for:\n\n- Signing Verifiable Presentations  \n- Proofs of key ownership in OIDC4VCI  \n- JWTs for OAuth2 client authentication  \n- Internal signature operations  \n\nBenefits:\n\n- Private key **never leaves KMS**  \n- Agent identity is tied to a secure execution environment  \n- High‑assurance signatures\n\n## 6.2 🔑 Developer-supplied keys\nDevelopers may register additional public JWKs:\n\n- For OAuth `private_key_jwt`  \n- For agent frameworks managing their own keys  \n- For corporate signing keys  \n\nWallet4Agent stores the public keys; developers retain the private keys.\n\n---\n\n# 7. 🔑 Authentication Methods\n\nWallet4Agent supports **three** agent authentication flows:\n\n## 7.1 🔹 Agent Personal Access Token (PAT)\n\n```\nAuthorization: Bearer <agent_pat>\n```\n\nSimple and effective for development or local agents.\n\n## 7.2 🔹 OAuth2 Client Credentials  \n\nAgent receives:\n\n- `client_id` = Agent DID  \n- `client_secret`  \n\nThen exchanges using:\n\n```\ngrant_type=client_credentials\n```\n\nIdeal for most production requests.\n\n## 7.3 🔹 OAuth2 private_key_jwt  \n\nStrongest method:\n\n- Developer registers a public JWK  \n- Agent signs a JWT with its private key  \n- Wallet4Agent validates it using the registered public JWK  \n\nUseful for hardware-backed keys and enterprise infrastructures.\n\n---\n\n# 8. 🧾 Credential Issuance (OIDC4VCI)\n\nWallet4Agent handles complete credential issuance flows:\n\n- Fetch issuer metadata  \n- Obtain OAuth tokens  \n- Create **proof of key ownership** signed by the agent's KMS key  \n- Request credentials  \n- Store as attestations  \n\nSupported formats:\n\n- 🟦 SD‑JWT VC  \n- 🟩 VC JSON‑LD  \n\nAgents only call MCP tools — Wallet4Agent does all protocol-level work.\n\n---\n\n# 9. 🧪 Verification (OIDC4VP)\n\nWallet4Agent supports verification of:\n\n- Natural persons  \n- Other agents  \n- Credential-based access  \n\nAgents can:\n\n- Start user verification  \n- Poll status  \n- Receive verified attributes safely  \n- Authenticate peer agents  \n\nThe agent never sees sensitive tokens; only derived, safe claims are returned.\n\n---\n\n# 10. 📦 Credential Storage & Retrieval\n\nWallet4Agent stores credentials as **attestations**, including:\n\n- Format  \n- Issuer  \n- VCT/VC type  \n- Expiry  \n- Encrypted payload  \n- Publication status (for Linked VP)  \n\nAgents can:\n\n- List their credentials  \n- Accept new ones  \n- Access credentials of other agents (if published)\n\n---\n\n# 11. 🌐 OAuth Protected Resource Metadata\n\nPublished under:\n\n```\n/.well-known/oauth-protected-resource/mcp\n```\n\nIncludes:\n\n- Supported authentication methods  \n- Resource identifiers  \n- Trusted authorization servers  \n\nEnables automatic configuration by OAuth2 clients and gateways.\n\n---\n\n# 12. 🛡️ Responsible AI Features\n\nWallet4Agent supports human-in-the-loop requirements:\n\n```json\n{\n  \"always_human_in_the_loop\": true\n}\n```\n\nUsed for:\n\n- High-risk operations  \n- Sensitive credential acceptance  \n- Escalation to human review  \n\n---\n\n\n## 🧩 13. Summary for Developers\n\nIf you are an Agent developer, Wallet4Agent gives you:\n\n| Feature | What you get |\n|--------|--------------|\n| 🆔 Agent identity | DID + DID Document |\n| 🔑 Authentication | Dev PAT, Agent PAT, OAuth2 Client Credentials, `private_key_jwt` |\n| 🔐 Cryptographic keys | Cloud KMS signatures, non‑exportable |\n| 📜 Credential issuance | Full OIDC4VCI support (SD‑JWT VC & VC JSON‑LD) |\n| ✅ Credential verification | OIDC4VP with simple MCP tools and safe derived claims |\n| 👤 Human interaction | QR code → wallet → verified attributes |\n| 🤝 Inter‑agent trust | Ability to inspect credentials of other agents (when authorized) |\n| ⚙️ Configuration | Auth mode, keys, policies all manageable via MCP |\n| 🛡️ Security | KMS, OAuth2, DID rotation & key updates, role‑separated tokens |\n\nYour AI Agent becomes a **verifiable digital entity**, capable of participating in decentralized and regulated digital identity ecosystems while preserving security and accountability.\n\n---\n\n**Maintainer:** Wallet4Agent (Web3 Digital Wallet / Talao )  \nFor feedback or additional documentation, use the contact channels on the Wallet4Agent website.\n\n| Standard                            | Purpose                                | Link                                                                                                                                                   |\n| ----------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |\n| **DID Core**                        | Core DID specification                 | [https://www.w3.org/TR/did-core/](https://www.w3.org/TR/did-core/)                                                                                     |\n| **Linked Verifiable Presentations** | Public VCs in DID Documents            | [https://identity.foundation/linked-vp/spec/v1.0.0/](https://identity.foundation/linked-vp/spec/v1.0.0/)                                               |\n| **OIDC4VCI**                        | Credential issuance                    | [https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html) |\n| **OIDC4VP**             | Credential presentation                | [https://openid.net/specs/openid-4-verifiable-presentations-1_0.html](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html)             |\n| **W3C Verifiable Credentials**      | VC Data Model                          | [https://www.w3.org/TR/vc-data-model-2.0/](https://www.w3.org/TR/vc-data-model-2.0/)                                                                   |\n| **SD-JWT VC (IETF)**                | Selective disclosure credential format | [https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-12.html](https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-12.html)               |\n",
  "bytes": 10243,
  "sha": "332e1c3a70a72f7550de87aaebd185a7109e47baa573f0ef03a5d4d741a0ee63",
  "repo_slug": "talaodao/connectors",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_com_wallet_connectors_wallet_verifier_mc_e664ce46/readme"
}