{
  "markdown": "# Bolyra\n\nVerified agent actions: authorization policy, signed receipts, and tamper-evident audit for AI agent tool calls.\n\n- **Domain:** [bolyra.ai](https://bolyra.ai)\n- **Company:** ZKProva Inc.\n- **License:** Apache-2.0 (with DCO sign-off — every commit requires `Signed-off-by:`)\n\n## What this is\n\nWhen an AI agent calls a tool, Bolyra proves who — and what — authorized the action. Put the gateway in front of any MCP server (or embed the verifier in your agent platform) and every tool call gets four checks: credential verification, per-tool policy, replay protection, and a signed audit receipt.\n\nBolyra ships in two tiers on the same verifier contract:\n\n- **Bolyra Core** — classical crypto, no circuits, no trusted setup: per-tool policy, nonce replay protection, ES256K-signed action receipts, credential binding against registered credentials, and JWT-based delegation claims ([`@bolyra/delegation`](delegation/)). This is the gateway's `--dev` mode; with a `credentials` section (or `--credentials`) configured, claimed identities and permission masks are enforced against the registry — unknown, forged, or expired credentials are denied fail-closed with signed receipts. Without registered credentials, permission claims remain self-asserted (the gateway warns at startup and flags the receipts).\n- **Bolyra ZK** — the privacy upgrade: humans prove uniqueness via a Semaphore v4-style enrollment circuit; AI agents prove EdDSA-signed credentials with cumulative-bit permissions; a delegation circuit narrows scope one-way (permissions can only drop, never widen), with the delegation path hidden from the verifier. A handshake binds the human and agent Groth16 proofs to a shared session nonce, verified atomically on-chain.\n\nCore gets you policy-gated, replay-protected, receipted actions. ZK gets you cryptographically bound verified actions **without disclosure** — the verifier learns that the predicate holds, not your credentials, policies, or delegation graph. You don't need ZK to gate your first MCP server with one command.\n\n**Building an agent platform?** Bolyra plugs in as an external verifier and gives you an enterprise security capability — verified agent actions — without rebuilding auth. See [bolyra.ai](https://bolyra.ai/#platforms).\n\n## Repository layout\n\n```\ncircuits/        Circom 2 circuits + snarkjs/rapidsnark proving\ncontracts/       Hardhat — Solidity verifiers + on-chain registry\nsdk/             @bolyra/sdk (TypeScript, public API)\nsdk-python/      bolyra (Python — pure types + subprocess bridge)\nintegrations/    langchain, crewai, mcp, openclaw, payment-protocols\nspec/            DID method, IETF-style draft, conformance runner\nexamples/        mcp-demo, provider-mock\ndocs/            quickstart, OWASP agentic mapping\n```\n\n## Quickstart\n\nSee [`sdk/QUICKSTART.md`](sdk/QUICKSTART.md) for the TypeScript SDK quickstart.\n\n## Build & test\n\n```sh\nnpm install\nnpm run compile:circuits\nnpm run compile:contracts\nnpm test                              # circuits fast + contracts\nFULL_PROOF=1 npm run test:circuits:slow  # full Groth16/PLONK proving (~2 min)\n```\n\n## Protocol Conformance\n\n112 executable test vectors verify the implementation matches the protocol specification.\nCI runs them on every PR. See [`spec/CONFORMANCE.md`](spec/CONFORMANCE.md) for the\ncurrent generated report.\n\n```bash\nnpm run conformance          # run all 112 vectors\nnpm run conformance:report   # generate spec/CONFORMANCE.md\n```\n\n**Implementing your own EVC host?** 28 of those vectors test *host* behavior and\nrun against any host in any language, with no install:\n\n```bash\nnpx @bolyra/evc-conformance --host \"/path/to/your-host --flags\"\n```\n\nSee [`spec/IMPLEMENTER.md`](spec/IMPLEMENTER.md) for the full pass path — the\nHost-Under-Test contract, failure classes, troubleshooting, and a CI snippet.\n\n## Contributing\n\nThis project requires a Developer Certificate of Origin (DCO) sign-off on every commit. Use `git commit -s`. See [`CONTRIBUTING.md`](CONTRIBUTING.md) for details.\n\n## License\n\nApache-2.0. See [`LICENSE`](LICENSE).\n",
  "bytes": 4061,
  "sha": "cb219d0bd16b4c319dfb2856a41f2d491e24f6cbad842a0e847194694894f6bf",
  "repo_slug": "bolyra/bolyra",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_bolyra_shield_4774aa55/readme"
}