{ "markdown": "# DNS-AID\n\n\n\n[![CI](https://github.com/dns-aid/dns-aid-core/actions/workflows/ci.yml/badge.svg)](https://github.com/dns-aid/dns-aid-core/actions/workflows/ci.yml)\n[![Security](https://github.com/dns-aid/dns-aid-core/actions/workflows/security.yml/badge.svg)](https://github.com/dns-aid/dns-aid-core/actions/workflows/security.yml)\n[![CodeQL](https://github.com/dns-aid/dns-aid-core/actions/workflows/codeql.yml/badge.svg)](https://github.com/dns-aid/dns-aid-core/actions/workflows/codeql.yml)\n[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/dns-aid/dns-aid-core/badge)](https://scorecard.dev/viewer/?uri=github.com/dns-aid/dns-aid-core)\n[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/12651/badge)](https://www.bestpractices.dev/projects/12651)\n[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)\n[![Python](https://img.shields.io/badge/python-3.11%20%7C%203.12%20%7C%203.13-blue)](https://www.python.org/)\n[![PyPI](https://img.shields.io/pypi/v/dns-aid)](https://pypi.org/project/dns-aid/)\n\n**DNS-based Agent Identification and Discovery**\n\nReference implementation for [IETF draft-mozleywilliams-dnsop-dnsaid-02](https://datatracker.ietf.org/doc/draft-mozleywilliams-dnsop-dnsaid/).\n\nDNS-AID enables AI agents to discover each other via DNS, using the internet's existing naming infrastructure instead of centralized registries or hardcoded URLs.\n\n## Relationship to IETF\n\nThe DNS-AID specification is being developed within the IETF: https://datatracker.ietf.org/doc/draft-mozleywilliams-dnsop-dnsaid/.\n\nThis repository provides a reference implementation.\n\nThis project does not define the specification. The IETF draft is authoritative.\n\n## Scope of this Repository\n\nThis project focuses on implementation, tooling, and ecosystem activities.\n\nChanges to protocol behavior should be discussed within the IETF.\n\n> **New to DNS-AID?** Start with the [Getting Started Guide](docs/getting-started.md) for install, first agent publication, and backend setup.\n\n## Documentation\n\n- [Getting Started Guide](docs/getting-started.md) — install, first agent publication, backend setup\n- [API Reference](docs/api-reference.md) — Python SDK, CLI, and MCP server tool reference\n- [ARD ai-catalog discovery](docs/ard-catalog.md) — interop with [Agentic Resource Discovery](https://agenticresourcediscovery.org/spec/): catalog discovery, the host-anywhere DNS pointer, and card dereferencing\n- [Architecture](docs/architecture.md) — protocol layers, metadata resolution, integration points\n- [Integrations](docs/integrations.md) — backend-specific setup notes\n- [Demo Guide](docs/demo-guide.md) — end-to-end walkthrough for talks and presentations\n- [Roadmap](docs/roadmap.md) — where the project is headed, near/medium/long term\n- [Privacy Policy](PRIVACY.md) | [Security Policy](SECURITY.md) | [Trademarks](TRADEMARKS.md)\n\n## Ecosystem and Integrations\n\nDNS-AID is a **substrate**. The library in this repository is sufficient on its own — it publishes and resolves agent records against any DNS provider, with no dependency on a particular directory, indexer, or telemetry backend.\n\nWhen a search, indexing, or telemetry layer is useful, the SDK can point at any HTTP endpoint that implements the documented interfaces. Operators are encouraged to run their own — the indexer is a thin layer over the same DNS records this library publishes and discovers, and the SDK telemetry sink is configurable via `DNS_AID_SDK_HTTP_PUSH_URL` (off by default). Independent directory implementations exist across the ecosystem; DNS-AID is designed to remain interoperable with any of them rather than canonicalize a single one.\n\n## Quick Start\n\n### Install\n\n```bash\n# Install from PyPI\npip install \"dns-aid[cli,mcp]\"\n\n# Or install the latest unreleased main from GitHub\npip install \"dns-aid[cli,mcp] @ git+https://github.com/dns-aid/dns-aid-core.git\"\n```\n\nFor backend-specific extras (`route53`, `cloudflare`, `ns1`, `cloud_dns`, `infoblox`, `akamai-edgedns`, `ddns`), see the [Getting Started Guide](docs/getting-started.md#install).\n\n### Python Library\n\n```python\nimport dns_aid\n\n# Publish your agent to DNS\nawait dns_aid.publish(\n name=\"my-agent\",\n domain=\"example.com\",\n protocol=\"mcp\",\n endpoint=\"agent.example.com\",\n capabilities=[\"chat\", \"code-review\"]\n)\n\n# Discover agents at a domain (Path A: DNS substrate)\nagents = await dns_aid.discover(\"example.com\")\nfor agent in agents:\n print(f\"{agent.name}: {agent.endpoint_url}\")\n\n# Discover via HTTP index (richer metadata; format aligns with the ANS schema) —\n# also auto-detects and dereferences ARD ai-catalogs (see docs/ard-catalog.md)\nagents = await dns_aid.discover(\"example.com\", use_http_index=True)\n# (0.26.3+) A catalog on your own domain needs nothing. An off-domain catalog\n# pointer is trusted only via per-record JWS (verify_signatures=True) or, opt-in,\n# a DNSSEC-validated pointer (trust_dnssec_pointers=True) — otherwise it is ignored\n# and discovery falls back to the on-domain catalog. The trust basis is surfaced as\n# AgentRecord.catalog_trust (tls_domain | dnssec | jws). See docs/ard-catalog.md.\n\n# (0.26.4+) Opt-in DNSSEC/DANE hardening (SDK/CLI/MCP; all default off — DNSSEC is\n# never required). require_dnssec / min_dnssec enforce the resolver AD flag on\n# DNS-plane agents (ARD / HTTP-catalog agents are exempt — they carry no DNS SVCB\n# record). verify_dane binds each agent endpoint's TLS cert to its DANE/TLSA record\n# (defense-in-depth, meaningful only under DNSSEC) → AgentRecord.dane_verified.\n# (0.26.5+) trust_dnssec_pointers (above) is exposed the same way — CLI\n# --trust-dnssec-pointers / MCP — so all four opt-in trust controls have SDK/CLI/MCP parity.\n\n# Filtered discovery — pure-Python predicates over the in-memory result (v0.19.0+)\nresult = await dns_aid.discover(\n \"example.com\",\n capabilities=[\"payment-processing\"],\n auth_type=\"oauth2\",\n realm=\"prod\",\n require_signed=True,\n require_signature_algorithm=[\"ES256\", \"Ed25519\"],\n)\n\n# Verify an agent's DNS records\nresult = await dns_aid.verify(\"my-agent.example.com\")\nprint(f\"Security Score: {result.security_score}/100\")\n```\n\n### Path B: cross-domain search via an external directory (v0.19.0+)\n\nWhen the caller does not yet know which domain hosts the agent it wants, the SDK can query any directory backend that implements the search endpoint. The directory layer is **opt-in convenience**; the DNS substrate remains the authoritative trust gate.\n\n```python\nfrom dns_aid.sdk import AgentClient, SDKConfig\n\n# Point at whichever directory the caller has chosen to trust.\n# Can also be set via DNS_AID_SDK_DIRECTORY_API_URL.\nconfig = SDKConfig(directory_api_url=\"https://your-directory.example.com\")\n\nasync with AgentClient(config=config) as client:\n response = await client.search(q=\"payment processing\", protocol=\"mcp\")\n for r in response.results:\n print(r.agent.fqdn)\n```\n\nAfter the directory returns candidates, re-resolve each one through Path A and validate signatures / DNSSEC before invoking. This is the substrate-as-authority pattern: the directory provides ranking and discovery convenience, but never sits in the trust path between the caller and the agent.\n\n```python\nasync with AgentClient(config=config) as client:\n response = await client.search(q=\"fraud detection\")\n for candidate in response.results:\n verified = await dns_aid.discover(\n candidate.agent.domain,\n name=candidate.agent.name,\n require_signed=True,\n )\n # Invoke only when DNS substrate confirms the directory's claim.\n```\n\nThe SDK exposes additional filter parameters (`capabilities`, `min_security_score`, `verified_only`, etc.) for directories that compute and return those signals; see [API Reference](docs/api-reference.md) for the full surface. The semantics of those values are defined by whichever directory the caller has chosen — DNS-AID does not centralize them.\n\n### SDK: Invoke Agents & Capture Telemetry (v0.6.0+)\n\n```python\nimport dns_aid\n\n# Discover + invoke in one line — telemetry captured automatically\nresult = await dns_aid.discover(\"example.com\", protocol=\"mcp\")\nagent = result.agents[0]\n\nresp = await dns_aid.invoke(agent, method=\"tools/list\")\nprint(f\"Latency: {resp.signal.invocation_latency_ms}ms\")\nprint(f\"Status: {resp.signal.status}\")\nprint(f\"Tools: {resp.data}\")\n\n# Rank multiple agents by your own local telemetry signals\nranked = await dns_aid.rank(result.agents, method=\"tools/list\")\nfor r in ranked:\n print(f\"{r.agent_fqdn}: score={r.composite_score:.1f}\")\n```\n\n**OpenTelemetry (v0.23.0+):** install `dns-aid[otel]` and set\n`otel_enabled=True` (or `DNS_AID_SDK_OTEL_ENABLED=true`) to emit spans +\nmetrics per invoke and propagate W3C trace context to downstream agents.\nSee [docs/integrations/opentelemetry.md](docs/integrations/opentelemetry.md).\n\nFor advanced usage (connection reuse, OpenTelemetry export, pluggable telemetry sink):\n\n```python\nfrom dns_aid.sdk import AgentClient, SDKConfig\n\nconfig = SDKConfig(\n otel_enabled=True, # Export to any OpenTelemetry collector\n caller_id=\"my-app\",\n # Optional: push telemetry to any HTTP endpoint the caller controls\n # http_push_url=\"https://your-telemetry.example.com/v1/signals\",\n)\n\nasync with AgentClient(config=config) as client:\n resp = await client.invoke(agent, method=\"tools/call\", arguments={...})\n fqdns = [a.fqdn for a in agents]\n ranked = client.rank(fqdns) # Rank by the caller's own observed telemetry\n```\n\nIf an external aggregator publishes community-wide rankings over HTTP, the SDK can fetch them via `client.fetch_rankings(...)`; the endpoint is configured by the caller, not by the library.\n\n### SDK: Per-Invoke Credential Provider Callback (v0.21.0+)\n\nFor short-lived credentials (RFC 8693 token exchange, AWS STS assume-role,\nHashiCorp Vault dynamic secrets, HSM/KMS-backed signing keys), pass an opt-in\nasync `credential_provider` callback to `invoke()`. The SDK awaits the callback\nlazily at invoke time with the target `AgentRecord` and uses the returned dict\nfor auth resolution. Strictly additive — every existing call site continues to\nwork without source change.\n\n```python\nasync def token_exchange_provider(agent: AgentRecord) -> dict[str, str]:\n # Mint a fresh delegation token per call — e.g., RFC 8693 token exchange\n # against Keycloak / Okta / Auth0 / Microsoft Entra ID.\n return {\"token\": await my_idp.exchange_token(subject_token, agent.fqdn)}\n\nasync with AgentClient(config=config) as client:\n resp = await client.invoke(\n agent,\n method=\"tools/list\",\n credential_provider=token_exchange_provider,\n )\n```\n\nPrecedence: `auth_handler > credentials > credential_provider > no_auth`.\nSee [docs/security-credentials.md](docs/security-credentials.md) for the\nper-handler security matrix, audit-trail flow, and the\n[`examples/integration_oauth2_token_exchange.py`](examples/integration_oauth2_token_exchange.py)\nand [`examples/integration_aws_sts_assume_role.py`](examples/integration_aws_sts_assume_role.py)\ncanonical patterns.\n\n## CLI Usage\n\n```bash\n# Publish an agent to DNS\ndns-aid publish \\\n --name my-agent \\\n --domain example.com \\\n --protocol mcp \\\n --endpoint agent.example.com \\\n --capability chat \\\n --capability code-review\n\n# Publish with transport and auth metadata (v0.10.0+)\ndns-aid publish \\\n --name billing \\\n --domain example.com \\\n --protocol mcp \\\n --endpoint mcp.example.com \\\n --capability billing --capability invoicing \\\n --transport streamable-http \\\n --auth-type bearer\n\n# Publish with DNS-AID custom SVCB parameters (v0.4.8+)\ndns-aid publish \\\n --name booking \\\n --domain example.com \\\n --protocol mcp \\\n --endpoint mcp.example.com \\\n --capability travel --capability booking \\\n --cap-uri https://mcp.example.com/.well-known/agent-cap.json \\\n --cap-sha256 dGVzdGhhc2g \\\n --bap \"mcp/1,a2a/1\" \\\n --policy-uri https://example.com/agent-policy \\\n --realm production\n\n# Discover agents at a domain (pure DNS - default)\ndns-aid discover example.com\n\n# Discover with substrate filters\ndns-aid discover example.com --protocol mcp --name chat\n\n# Discover with in-memory filters (v0.19.0+)\ndns-aid discover example.com \\\n --capabilities payment-processing --capabilities fraud-detection \\\n --auth-type oauth2 --realm prod \\\n --require-signed --require-signature-algorithm ES256\n\n# Cross-domain search via a directory the caller has chosen (v0.19.0+)\nexport DNS_AID_SDK_DIRECTORY_API_URL=https://your-directory.example.com\ndns-aid search \"payment processing\" --protocol mcp\n\n# Discover via HTTP index (richer metadata; format aligns with the ANS schema)\ndns-aid discover example.com --use-http-index\n\n# Output as JSON\ndns-aid discover example.com --json\n\n# Verify DNS records\ndns-aid verify my-agent.example.com\n\n# List DNS-AID records in a zone\ndns-aid list example.com\n\n# List available zones (Route 53)\ndns-aid zones\n\n# Delete an agent\ndns-aid delete --name my-agent --domain example.com --protocol mcp\n\n# Index Management (v0.3.0+)\n# List agents in a domain's index record\ndns-aid index list example.com\n\n# Sync index with actual DNS records (useful for repair)\ndns-aid index sync example.com\n\n# Advertise an ARD ai-catalog via DNS pointer (host-anywhere; v0.26.0+)\n# Publishes _catalog._agents + _index._agents SVCB → the catalog host.\ndns-aid index publish-catalog example.com catalogue.example.com\n\n# Publish without updating the index (for internal agents)\ndns-aid publish --name internal-bot --domain example.com --protocol mcp --no-update-index\n\n# Domain Submission to a Directory (v0.4.0+)\n# Submit your domain to a directory of your choice for indexing.\n# The --to flag (or DNS_AID_SDK_DIRECTORY_API_URL) selects which directory.\ndns-aid submit example.com --to https://your-directory.example.com\n\n# Submit with company metadata\ndns-aid submit example.com \\\n --to https://your-directory.example.com \\\n --company-name \"Example Corp\" \\\n --company-website \"https://example.com\" \\\n --company-description \"We build AI agents\"\n```\n\n### Agent Index Records\n\nDNS-AID v0.3.0 automatically maintains an index record at `_index._agents.{domain}` for efficient discovery:\n\n```\n_index._agents.example.com. TXT \"agents=chat:mcp,billing:a2a,support:https\"\n```\n\n**Benefits:**\n- Single DNS query discovers all agents at a domain\n- Crawlers can efficiently index domains\n- Explicit list of published agents (no guessing)\n\nThe index is updated automatically when you `publish` or `delete` agents. Use `--no-update-index` to opt out for internal agents.\n\n### Domain Control Validation (v0.20.0+)\n\nDCV lets one party prove to another that they control a DNS zone, using a short-lived\nTXT record challenge. Two use cases: anonymous agents asserting org affiliation, and\ndirectory anti-impersonation before listing an agent as org-verified.\n\n```bash\n# Challenger: issue a challenge for a domain\nCHALLENGE=$(dns-aid dcv issue orgb.example.com --agent assistant --issuer orga.example.com --json)\nTOKEN=$(echo $CHALLENGE | python3 -c \"import sys,json; print(json.load(sys.stdin)['token'])\")\n\n# Claimant: place the challenge TXT record in the zone (using their own DNS credentials)\ndns-aid dcv place orgb.example.com $TOKEN\n\n# Challenger: verify the record is present and unexpired\ndns-aid dcv verify orgb.example.com $TOKEN\n\n# Claimant: revoke after successful verification\ndns-aid dcv revoke orgb.example.com $TOKEN\n```\n\n```python\nfrom dns_aid.core import dcv\n\n# Challenger\nchallenge = dcv.issue(\"orgb.example.com\", agent_name=\"assistant\", issuer_domain=\"orga.example.com\")\n# ... deliver challenge out-of-band to claimant ...\n\n# Claimant (different process, different credentials)\nawait dcv.place(challenge.domain, challenge.token, bnd_req=challenge.bnd_req)\n\n# Challenger\nresult = await dcv.verify(challenge.domain, challenge.token, expected_bnd_req=challenge.bnd_req)\nif result.verified:\n await dcv.revoke(challenge.domain, token=challenge.token)\n```\n\nSee [Domain Control Validation](docs/api-reference.md#domain-control-validation-dcv) in the API reference for full details.\n\n### HTTP Index Discovery\n\nDNS-AID also supports HTTP-based agent discovery, with an index format whose schema aligns with ANS-style directories. This provides richer metadata (descriptions, model cards, capabilities, costs) while still validating endpoints via DNS.\n\n**Endpoint patterns tried (in order):**\n1. `https://index.aiagents.{domain}/index-wellknown` (demo-friendly, no underscores)\n2. `https://_index._aiagents.{domain}/index-wellknown` (ANS-style)\n3. `https://{domain}/.well-known/agents-index.json` (well-known path)\n\n**Capability Document endpoint (v0.4.8+):**\n- `https://index.aiagents.{domain}/cap/{agent-name}` — returns a capability document JSON per agent\n\n```bash\n# Fetch HTTP index directly\ncurl https://index.aiagents.example.com/index-wellknown\n\n# Fetch capability document for a specific agent\ncurl https://index.aiagents.example.com/cap/booking-agent\n\n# CLI with HTTP index\ndns-aid discover example.com --use-http-index\n```\n\n```python\n# Python with HTTP index\nagents = await dns_aid.discover(\"example.com\", use_http_index=True)\n```\n\n| Discovery Method | When to Use |\n|-----------------|-------------|\n| **DNS (default)** | Maximum decentralization, offline caching, minimal round trips |\n| **HTTP Index** | Rich metadata upfront, ANS compatibility, model cards, capabilities, direct endpoints |\n\n**FQDN as Source of Truth (v0.4.7):** The HTTP index only needs to provide each agent's FQDN (e.g., `booking.example.com`). Agent name and protocol are extracted from the FQDN — no separate `protocols` field needed. DNS SVCB lookup then resolves the authoritative endpoint.\n\n**Discovery Transparency (v0.4.6+):** Each discovered agent includes source fields showing how data was resolved:\n\n| Field | Values | Description |\n|-------|--------|-------------|\n| `endpoint_source` | `dns_svcb`, `http_index_fallback`, `direct` | How the endpoint was resolved |\n| `capability_source` | `cap_uri`, `txt_fallback`, `none` | How capabilities were discovered (v0.4.8+) |\n\n**Capability Resolution (v0.4.8+):** Capabilities are resolved with the following priority:\n1. **SVCB `cap` URI** → fetch capability document (JSON with capabilities, version, description)\n2. **TXT record fallback** → `capabilities=chat,support` from DNS TXT record\n3. **HTTP Index inline** → capabilities embedded in the index JSON response\n\n## MCP Server\n\nDNS-AID includes an MCP (Model Context Protocol) server that allows AI agents like Claude to publish and discover other agents.\n\n### Running the MCP Server\n\n```bash\n# Run with stdio transport (default - for Claude Desktop, etc.)\ndns-aid-mcp\n\n# Run with HTTP transport\ndns-aid-mcp --transport http --port 8000\n```\n\n### Available MCP Tools\n\n| Tool | Description |\n|------|-------------|\n| `publish_agent_to_dns` | Publish an AI agent to DNS (auto-updates index) |\n| `discover_agents_via_dns` | Discover AI agents at a domain (supports `use_http_index` for HTTP-index discovery) |\n| `list_agent_tools` | List available tools on a discovered MCP agent |\n| `call_agent_tool` | Call a tool on a discovered MCP agent (proxy requests) |\n| `verify_agent_dns` | Verify DNS-AID records and security |\n| `list_published_agents` | List all agents in a domain |\n| `delete_agent_from_dns` | Remove an agent from DNS (auto-updates index) |\n| `list_agent_index` | List agents in domain's index record |\n| `sync_agent_index` | Sync index with actual DNS records |\n| `diagnose_environment` | Run environment diagnostics (deps, DNS, backends) |\n\n### Claude Desktop Integration\n\nAdd to your Claude Desktop config (`~/Library/Application Support/Claude/claude_desktop_config.json`):\n\n```json\n{\n \"mcpServers\": {\n \"dns-aid\": {\n \"command\": \"dns-aid-mcp\"\n }\n }\n}\n```\n\nThen Claude can discover and connect to AI agents:\n\n> \"Find available agents at example.com\"\n>\n> \"Publish my chat agent to DNS at mycompany.com\"\n>\n> \"Discover agents at example.com and search for flights from SFO to JFK\"\n\n#### Live Demo\n\nTry the live demo with Claude Desktop:\n\n```json\n{\n \"mcpServers\": {\n \"dns-aid\": {\n \"command\": \"python\",\n \"args\": [\"-m\", \"dns_aid.mcp.server\"]\n }\n }\n}\n```\n\nThen ask Claude to discover and use the booking agent:\n\n> \"Discover agents at example.com using HTTP index, find a booking agent, and search for flights from SFO to JFK on March 15th 2026\"\n\nClaude will:\n1. Call `discover_agents_via_dns` → finds booking-agent at `https://booking.example.com/mcp`\n2. Call `list_agent_tools` → sees search_flights, get_flight_details, check_availability, create_reservation\n3. Call `call_agent_tool` → searches for flights and returns results\n\n## How It Works\n\nDNS-AID uses SVCB records (RFC 9460) to advertise AI agents:\n\n```\nchat.example.com. 3600 IN SVCB 1 chat.example.com. alpn=\"a2a\" port=443 mandatory=\"alpn,port\"\nchat.example.com. 3600 IN TXT \"capabilities=chat,assistant\" \"version=1.0.0\"\n```\n\n**DNS-AID Custom SVCB Parameters (v0.4.8+):** Per the IETF draft, SVCB records can carry additional custom parameters for richer agent metadata:\n\n```\nbooking.example.com. SVCB 1 mcp.example.com. alpn=\"mcp\" port=443 \\\n cap=\"https://mcp.example.com/.well-known/agent-cap.json\" \\\n cap-sha256=\"dGVzdGhhc2g\" bap=\"mcp/1,a2a/1\" \\\n policy=\"https://example.com/agent-policy\" realm=\"production\"\n```\n\n| Parameter | Purpose |\n|-----------|---------|\n| `cap` | URI to capability document (rich JSON metadata) |\n| `cap-sha256` | SHA-256 digest of capability descriptor for integrity verification |\n| `bap` | Supported bulk agent protocols with versioning |\n| `policy` | URI to agent policy document |\n| `realm` | Multi-tenant scope identifier |\n\nThis allows any DNS client to discover agents without proprietary protocols or central registries.\n\n### Discovery Flow (DNS-AID Draft Aligned)\n\n```\n Agent A DNS Agent B\n │ │ │\n │ \"Find agents at │ │\n │ salesforce.com\" │ │\n │ │ │\n ┌──┴──────────────────────────────────────────────────────────────┐\n │ Step 1: Fetch HTTP Index (primary) │\n │ ────────────────────────────────── │\n │ GET https://index.aiagents.salesforce.com/index-wellknown │\n │ Response: [{\"fqdn\":\"chat.salesforce.com\",...}] │\n │ │\n │ Fallback: Query TXT Index via DNS │\n │ Query: _index._agents.salesforce.com TXT │\n │ Response: \"agents=chat:a2a,billing:mcp\" │\n └──┬──────────────────────────────────────────────────────────────┘\n │ │ │\n ┌──┴──────────────────────────────────────────────────────────────┐\n │ Step 2: Query SVCB per agent │\n │ ──────────────────────────── │\n │ Query: chat.salesforce.com SVCB │\n │ Response: SVCB 1 chat.salesforce.com. alpn=\"a2a\" port=443 │\n │ cap=\"https://chat.salesforce.com/.well-known/cap.json\"│\n │ (DNSSEC validated) │\n └──┬──────────────────────────────────────────────────────────────┘\n │ │ │\n ┌──┴──────────────────────────────────────────────────────────────┐\n │ Step 2b: Fetch Capability Document (if cap URI present) │\n │ ─────────────────────────────────────────────────── │\n │ GET https://chat.salesforce.com/.well-known/cap.json │\n │ Response: {\"capabilities\":[\"chat\",\"support\"],\"version\":\"1.0\"} │\n │ (cap_sha256 integrity verified) │\n └──┬──────────────────────────────────────────────────────────────┘\n │ │ │\n ┌──┴──────────────────────────────────────────────────────────────┐\n │ Step 3: TXT Capabilities (fallback if no cap document) │\n │ ────────────────────────────────────────────────── │\n │ Query: chat.salesforce.com TXT │\n │ Response: \"capabilities=chat,support\" \"version=1.0.0\" │\n └──┬──────────────────────────────────────────────────────────────┘\n │ │ │\n ├────────────────────────────────────────────────────────────►│\n │ Connect to https://chat.salesforce.com:443 │\n```\n\n**Index Resolution Priority:** HTTP index endpoint → TXT index record → common name probing.\n**Capability Resolution Priority:** SVCB `cap` URI → capability document → TXT record fallback.\nEach discovered agent includes `endpoint_source` and `capability_source` showing which path was used.\n\n## Agent Metadata Contract (v0.10.0+)\n\nDNS discovery tells you WHERE an agent is. The **Agent Metadata Contract** tells you HOW to connect, WHAT it can do, and WHETHER it's still active.\n\nEvery DNS-AID agent can serve a `.well-known/agent.json` endpoint:\n\n```\nGET https://mcp.example.com/.well-known/agent.json\n\n{\n \"aid_version\": \"1.0\",\n \"identity\": { \"name\": \"billing\", \"version\": \"2.1.0\", \"deprecated\": false },\n \"connection\": { \"protocol\": \"mcp\", \"transport\": \"streamable-http\" },\n \"auth\": { \"type\": \"bearer\", \"header_name\": \"Authorization\" },\n \"capabilities\": {\n \"supports_streaming\": true,\n \"actions\": [\n { \"name\": \"get_invoice\", \"intent\": \"query\", \"semantics\": \"read\" },\n { \"name\": \"process_payment\", \"intent\": \"transaction\", \"semantics\": \"write\" }\n ]\n }\n}\n```\n\n**Why this matters for orchestrators (LangGraph, CrewAI, etc.):**\n\n| Field | Orchestrator Decision |\n|-------|----------------------|\n| `intent: query` | Safe to call in parallel, cacheable |\n| `intent: transaction` | Needs atomic execution, rollback on failure |\n| `semantics: read` | Safe to retry on timeout |\n| `semantics: write` | NOT safe to retry — may duplicate side effects |\n| `auth.type: oauth2` | Needs token exchange before calling |\n| `deprecated: true` | Route to `successor_fqdn` instead |\n\n**A2A Compatibility:** Both DNS-AID and Google A2A use `/.well-known/agent.json`. The metadata fetcher auto-detects the format — DNS-AID native (has `aid_version` key) or A2A Agent Card — and normalizes both into the same metadata fields.\n\n## Architecture\n\n### Client-Side: Toolkit\n\n```\n┌─────────────────┐ ┌─────────────────┐ ┌─────────────────────────┐\n│ AI Agents │ │ Developers │ │ Infrastructure Ops │\n│ (Claude, etc.) │ │ │ │ │\n└────────┬────────┘ └────────┬────────┘ └────────────┬────────────┘\n │ │ │\n │ MCP Protocol │ CLI │ CLI / API\n ▼ ▼ ▼\n┌─────────────────────────────────────────────────────────────────────────┐\n│ DNS-AID TOOLKIT │\n│ │\n│ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────────────┐ │\n│ │ MCP Server │ │ CLI │ │ Python Library │ │\n│ │ │ │ │ │ │ │\n│ │ • publish_agent │ │ • dns-aid │ │ • dns_aid.publish() │ │\n│ │ • discover_ │ │ publish │ │ • dns_aid.discover() │ │\n│ │ agents │ │ • dns-aid │ │ • dns_aid.verify() │ │\n│ │ • verify_agent │ │ discover │ │ • dns_aid.invoke() ◄── Tier 1 SDK\n│ │ • list_agents │ │ • dns-aid │ │ • dns_aid.rank() │ │\n│ │ • call_agent │ │ verify │ │ │ │\n│ └────────┬────────┘ └────────┬────────┘ └────────────┬────────────┘ │\n│ │ │ │ │\n│ └────────────────────┴────────────────────────┘ │\n│ │ │\n│ ▼ │\n│ ┌─────────────────────────────────────────────────────────────────┐ │\n│ │ CORE ENGINE │ │\n│ │ │ │\n│ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────────────────┐ │ │\n│ │ │ Publisher │ │ Discoverer │ │ Validator │ │ │\n│ │ │ │ │ │ │ │ │ │\n│ │ │ Create SVCB │ │ Query DNS │ │ • DNSSEC validation │ │ │\n│ │ │ Create TXT │ │ Parse SVCB │ │ • DANE/TLSA check │ │ │\n│ │ │ │ │ Return │ │ • Endpoint health │ │ │\n│ │ │ │ │ endpoints │ │ │ │ │\n│ │ └──────┬──────┘ └──────┬──────┘ └────────────┬────────────┘ │ │\n│ │ │ │ │ │ │\n│ └─────────┴────────────────┴──────────────────────┴──────────────┘ │\n│ │ │\n└─────────────────────────────┼────────────────────────────────────────┘\n │\n ▼\n┌──────────────────────────────────────────────────────────────────────────────────────────────┐\n│ DNS BACKEND ABSTRACTION │\n│ │\n│ ┌───────────┐ ┌───────────┐ ┌───────────┐ ┌───────────┐ ┌───────────┐ ┌───────────┐ │\n│ │ Route53 │ │ Infoblox │ │ DDNS │ │Cloudflare │ │ Akamai │ │ Mock │ │\n│ │ (AWS) │ │ UDDI │ │ (RFC2136) │ │ │ │ Edge DNS │ │ (Testing) │ │\n│ └─────┬─────┘ └─────┬─────┘ └─────┬─────┘ └─────┬─────┘ └─────┬─────┘ └─────┬─────┘ │\n│ │ │ │ │ │ │ │\n└────────┴──────────────┴──────────────┴──────────────┴──────────────┴──────────────┴──────────┘\n │\n ▼\n┌─────────────────────────────────────────────────────────────────────────┐\n│ DNS INFRASTRUCTURE │\n│ │\n│ Authoritative DNS servers hosting _agents.{domain} zones │\n│ with SVCB, TXT, and TLSA records secured by DNSSEC │\n└─────────────────────────────────────────────────────────────────────────┘\n```\n\n### Directory and Indexing Layer (External)\n\nDirectory and indexing services that build on top of DNS-AID — crawlers that walk public DNS for agent records, services that index `.well-known/agent.json` metadata, search frontends — are **out of scope for this repository**. They build on the substrate but are operated independently. Implementations are free to define their own scoring, ranking, and curation policy; DNS-AID does not centralize those choices.\n\n## Choosing the Right Interface\n\nDNS-AID provides three interfaces. Choose based on your use case:\n\n### Python Library\n\n**Best for:** Application developers building agent discovery into their code.\n\n```python\nimport dns_aid\n\n# Integrate directly into your Python application\nagents = await dns_aid.discover(\"example.com\", protocol=\"mcp\")\n```\n\n| Use Case | Example |\n|----------|---------|\n| Building an AI agent that discovers other agents | Agent mesh applications |\n| Embedding discovery into existing Python apps | Adding DNS-AID to a Flask/FastAPI service |\n| Automated pipelines and scripts | CI/CD, scheduled publishing |\n| Unit testing with mock backend | Testing without real DNS |\n\n### CLI Tool\n\n**Best for:** Operators, DevOps, and quick manual operations.\n\n```bash\ndns-aid discover example.com --protocol mcp\n```\n\n| Use Case | Example |\n|----------|---------|\n| Manual publishing/discovery | Testing a new agent deployment |\n| Shell scripts and automation | `cron` jobs, deployment scripts |\n| Debugging and troubleshooting | Checking DNS records exist |\n| Zone management | Listing agents, bulk operations |\n\n### MCP Server\n\n**Best for:** AI assistants (Claude, etc.) that need DNS-AID capabilities.\n\n```bash\ndns-aid-mcp # Claude can now use DNS-AID tools\n```\n\n| Use Case | Example |\n|----------|---------|\n| Claude Desktop integration | \"Find agents at salesforce.com\" |\n| AI-driven infrastructure | Agent self-registration and discovery |\n| Natural language DNS management | \"Publish my chat agent to DNS\" |\n| Building agentic workflows | Multi-agent orchestration |\n\n### Decision Matrix\n\n| You want to... | Use |\n|----------------|-----|\n| Build discovery into your Python app | **Python Library** |\n| Run ad-hoc commands from terminal | **CLI** |\n| Automate with shell scripts | **CLI** |\n| Enable Claude/AI to manage DNS-AID | **MCP Server** |\n| Test without real DNS | **Python Library** (with MockBackend) |\n| Debug DNS record issues | **CLI** (`dns-aid verify`) |\n\n## DNS Backends\n\nFor per-provider environment configuration, see the [Getting Started Guide](docs/getting-started.md) backend sections.\n\nDNS-AID supports multiple DNS backends:\n\n| Backend | Description | Install Extra | Status |\n|---------|-------------|---------------|--------|\n| Akamai Edge DNS | Akamai Edge DNS | `dns-aid[akamai-edgedns]` | ✅ Production |\n| Route 53 | AWS Route 53 | `dns-aid[route53]` | ✅ Production |\n| Cloudflare | Cloudflare DNS | `dns-aid[cloudflare]` | ✅ Production |\n| NS1 | NS1 (now IBM) Managed DNS | `dns-aid[ns1]` | ✅ Production |\n| Google Cloud DNS | GCP Cloud DNS | `dns-aid[cloud-dns]` | ✅ Production |\n| Infoblox NIOS | Infoblox NIOS (on-prem WAPI) | `dns-aid[nios]` | ✅ Production |\n| Infoblox UDDI | Infoblox Universal DDI (cloud) | `dns-aid[infoblox]` | ✅ Production |\n| DDNS | RFC 2136 Dynamic DNS (BIND, etc.) | `dns-aid[ddns]` | ✅ Production |\n| Mock | In-memory (testing only) | (built-in) | ✅ Production |\n\n### Route 53 Setup\n\n1. Configure AWS credentials:\n ```bash\n export AWS_ACCESS_KEY_ID=\"your-access-key\"\n export AWS_SECRET_ACCESS_KEY=\"your-secret-key\"\n export AWS_DEFAULT_REGION=\"us-east-1\" # Optional\n ```\n\n Or use AWS CLI profiles:\n ```bash\n aws configure\n # Or use a named profile\n export AWS_PROFILE=\"my-profile\"\n ```\n\n2. Verify zone access:\n ```bash\n dns-aid zones\n ```\n\n3. Publish your agent:\n ```bash\n dns-aid publish -n my-agent -d myzone.com -p mcp -e mcp.myzone.com\n ```\n\n### Infoblox UDDI Setup\n\nInfoblox UDDI (Universal DDI) is Infoblox's cloud-native DDI platform. DNS-AID supports creating SVCB and TXT records via the Infoblox API.\n\n#### Environment Variables\n\n| Variable | Required | Default | Description |\n|----------|----------|---------|-------------|\n| `INFOBLOX_API_KEY` | Yes | - | Infoblox UDDI API key from Cloud Portal |\n| `INFOBLOX_DNS_VIEW` | No | `default` | DNS view name (zones exist within views) |\n| `INFOBLOX_BASE_URL` | No | `https://csp.infoblox.com` | API base URL |\n\n#### Step-by-Step Setup\n\n1. **Get your API key** from [Infoblox Cloud Portal](https://csp.infoblox.com):\n - Navigate to **Administration** → **API Keys**\n - Create a new API key with DNS permissions\n - Copy the key (shown only once)\n\n2. **Configure environment variables**:\n ```bash\n export INFOBLOX_API_KEY=\"your-api-key\"\n export INFOBLOX_DNS_VIEW=\"default\" # Or your specific view name\n ```\n\n3. **Identify your zone and view**:\n - In Infoblox Portal, go to **DNS** → **Authoritative Zones**\n - Note the zone name (e.g., `example.com`) and which view it belongs to\n\n4. **Use in Python**:\n ```python\n from dns_aid.backends.infoblox import InfobloxBloxOneBackend\n from dns_aid.core.publisher import set_default_backend\n from dns_aid import publish\n\n # Initialize backend (reads from environment variables)\n backend = InfobloxBloxOneBackend()\n\n # Or with explicit configuration\n backend = InfobloxBloxOneBackend(\n api_key=\"your-api-key\",\n dns_view=\"default\", # Your DNS view name\n )\n\n set_default_backend(backend)\n\n await publish(\n name=\"my-agent\",\n domain=\"example.com\",\n protocol=\"mcp\",\n endpoint=\"agent.example.com\",\n capabilities=[\"chat\", \"code-review\"]\n )\n ```\n\n#### Infoblox UDDI SVCB Support\n\nInfoblox UDDI supports **full ServiceMode SVCB** (RFC 9460): `priority > 0` with `svc_params`,\nincluding the standard keys (`alpn`, `port`, `mandatory`, `ipv4hint`, `ipv6hint`, ...) and the\nprivate-use range `key65280`–`key65534`. DNS-AID's custom parameters (`cap`, `cap-sha256`,\n`bap`, `policy`, `realm`, `sig`, `connect-class`, `connect-meta`, `enroll-uri` — encoded as\n`key65400`–`key65405`) are written **natively on the SVCB record**, not demoted to a TXT\ncompanion.\n\n| DNS-AID Requirement | Akamai Edge DNS | Route 53 | Infoblox UDDI |\n|---------------------|-----------------|----------|---------------|\n| ServiceMode (priority > 0) | ✅ | ✅ | ✅ |\n| `alpn` / `port` / `mandatory` | ✅ | ✅ | ✅ |\n| Private-use keys (cap/bap/policy/realm/sig/...) | ✅ | ✅ | ✅ |\n\nInfoblox UDDI and Akamai Edge DNS are **fully DNS-AID-compliant** ServiceMode SVCB backends.\n\n#### Verify Records via API\n\nSince Infoblox UDDI zones may not be publicly resolvable, verify records via the API:\n\n```python\nasync with InfobloxBloxOneBackend() as backend:\n async for record in backend.list_records(\"example.com\", name_pattern=\"my-agent\"):\n print(f\"{record['type']}: {record['fqdn']}\")\n```\n\n### DDNS Setup (RFC 2136)\n\nDDNS (Dynamic DNS) is a universal backend that works with any DNS server supporting RFC 2136, including BIND9, Windows DNS, PowerDNS, and Knot DNS. This is ideal for on-premise DNS infrastructure without vendor-specific APIs.\n\n#### Environment Variables\n\n| Variable | Required | Default | Description |\n|----------|----------|---------|-------------|\n| `DDNS_SERVER` | Yes | - | DNS server hostname or IP |\n| `DDNS_KEY_NAME` | Yes | - | TSIG key name |\n| `DDNS_KEY_SECRET` | Yes | - | TSIG key secret (base64) |\n| `DDNS_KEY_ALGORITHM` | No | `hmac-sha256` | TSIG algorithm |\n| `DDNS_PORT` | No | `53` | DNS server port |\n\n#### Step-by-Step Setup\n\n1. **Create a TSIG key** on your DNS server (BIND example):\n ```bash\n tsig-keygen -a hmac-sha256 dns-aid-key > /etc/bind/dns-aid-key.conf\n ```\n\n2. **Configure your zone** to allow updates with the key:\n ```\n zone \"example.com\" {\n type master;\n file \"/var/lib/bind/example.com.zone\";\n allow-update { key \"dns-aid-key\"; };\n };\n ```\n\n3. **Configure DNS-AID**:\n ```bash\n export DDNS_SERVER=\"ns1.example.com\"\n export DDNS_KEY_NAME=\"dns-aid-key\"\n export DDNS_KEY_SECRET=\"your-base64-secret\"\n ```\n\n4. **Use in Python**:\n ```python\n from dns_aid.backends.ddns import DDNSBackend\n from dns_aid import publish\n\n backend = DDNSBackend()\n # Or with explicit configuration\n backend = DDNSBackend(\n server=\"ns1.example.com\",\n key_name=\"dns-aid-key\",\n key_secret=\"base64secret==\",\n key_algorithm=\"hmac-sha256\"\n )\n\n await publish(\n name=\"my-agent\",\n domain=\"example.com\",\n protocol=\"mcp\",\n endpoint=\"agent.example.com\",\n backend=backend\n )\n ```\n\n#### DDNS Advantages\n\n- **Universal**: Works with BIND, Windows DNS, PowerDNS, Knot, and any RFC 2136 server\n- **No vendor lock-in**: Standard protocol, no proprietary APIs\n- **On-premise friendly**: Perfect for enterprise internal DNS\n- **Full DNS-AID compliance**: Supports ServiceMode SVCB with all parameters\n\n### Cloudflare Setup\n\nCloudflare DNS is ideal for demos, workshops, and quick prototyping thanks to its free tier and excellent API support. DNS-AID fully supports Cloudflare's SVCB record implementation, including **native private-use SVCB keys** — DNS-AID's custom parameters (`cap`, `cap-sha256`, `bap`, `policy`, `realm`, ...) are written directly to the SVCB record (`key65400`–`key65409`), with no TXT demotion.\n\n#### Environment Variables\n\n| Variable | Required | Default | Description |\n|----------|----------|---------|-------------|\n| `CLOUDFLARE_API_TOKEN` | Yes | - | API token with DNS edit permissions |\n| `CLOUDFLARE_ZONE_ID` | No | - | Zone ID (auto-discovered if not set) |\n\n#### Step-by-Step Setup\n\n1. **Create an API token** in Cloudflare Dashboard:\n - Go to **My Profile** → **API Tokens** → **Create Token**\n - Use the \"Edit zone DNS\" template or create custom with:\n - **Permissions**: Zone → DNS → Edit\n - **Zone Resources**: Include → Specific zone → your-domain.com\n - Copy the token (shown only once)\n\n2. **Configure environment variables**:\n ```bash\n export CLOUDFLARE_API_TOKEN=\"your-api-token\"\n # Optional: specify zone ID (otherwise auto-discovered from domain)\n export CLOUDFLARE_ZONE_ID=\"your-zone-id\"\n ```\n\n3. **Publish your first agent**:\n ```bash\n dns-aid publish \\\n --name my-agent \\\n --domain your-domain.com \\\n --protocol mcp \\\n --endpoint agent.your-domain.com \\\n --backend cloudflare\n ```\n\n4. **Use in Python**:\n ```python\n from dns_aid.backends.cloudflare import CloudflareBackend\n from dns_aid import publish\n\n # Initialize backend (reads from environment variables)\n backend = CloudflareBackend()\n\n # Or with explicit configuration\n backend = CloudflareBackend(\n api_token=\"your-api-token\",\n zone_id=\"optional-zone-id\", # Auto-discovered if not provided\n )\n\n await publish(\n name=\"my-agent\",\n domain=\"your-domain.com\",\n protocol=\"mcp\",\n endpoint=\"agent.your-domain.com\",\n backend=backend\n )\n ```\n\n#### Cloudflare Advantages\n\n- **Free tier**: DNS hosting is free for unlimited domains\n- **SVCB support**: Full RFC 9460 compliance with SVCB Type 64 records\n- **Native private-use SVCB keys**: DNS-AID custom params go straight into the SVCB record (`key65400`–`key65409`) — no TXT demotion, matching NS1 and NIOS\n- **Global anycast**: Fast DNS resolution worldwide\n- **Simple API**: Well-documented REST API v4\n- **Full DNS-AID compliance**: Supports ServiceMode SVCB with all parameters\n\n### Akamai Edge DNS Setup\n\nAkamai Edge DNS supports ServiceMode SVCB records with full private-use key support, making it fully compliant with the DNS-AID draft. All custom DNS-AID parameters (`cap`, `bap`, `realm`, etc.) are written directly into SVCB — no TXT demotion.\n\nWrites are safe under concurrency: the backend serializes its own writes per zone and automatically retries Akamai's transient `409 concurrentZoneModification` responses with exponential backoff.\n\n#### Environment Variables\n\n| Variable | Required | Default | Description |\n|----------|----------|---------|-------------|\n| `AKAMAI_HOST` | No* | - | EdgeGrid API hostname (e.g., `akab-xxxx.luna.akamaiapis.net`) |\n| `AKAMAI_CLIENT_TOKEN` | No* | - | EdgeGrid client token |\n| `AKAMAI_CLIENT_SECRET` | No* | - | EdgeGrid client secret |\n| `AKAMAI_ACCESS_TOKEN` | No* | - | EdgeGrid access token |\n| `AKAMAI_EDGERC` | No | `~/.edgerc` | Path to `.edgerc` credentials file |\n| `AKAMAI_EDGERC_SECTION` | No | `default` | Section within `.edgerc` to use |\n\n\\* Required if not using `.edgerc`. Environment variables take precedence over `.edgerc` when both are present.\n\n#### Step-by-Step Setup\n\n1. **Create API credentials** in Akamai Control Center:\n - Go to **Identity & Access** → **Create API Client**\n - Grant **DNS—Zone Record Management** read-write permission\n - Download the `.edgerc` file or note the four credential values\n\n2. **Configure credentials** (choose one):\n\n Via `.edgerc` file (Akamai standard):\n ```ini\n # ~/.edgerc\n [default]\n host = akab-xxxx.luna.akamaiapis.net\n client_token = akab-xxxx\n client_secret = xxxx\n access_token = akab-xxxx\n ```\n\n Via environment variables:\n ```bash\n export AKAMAI_HOST=\"akab-xxxx.luna.akamaiapis.net\"\n export AKAMAI_CLIENT_TOKEN=\"akab-xxxx\"\n export AKAMAI_CLIENT_SECRET=\"xxxx\"\n export AKAMAI_ACCESS_TOKEN=\"akab-xxxx\"\n ```\n\n3. **Publish your first agent**:\n ```bash\n dns-aid publish \\\n --name my-agent \\\n --domain your-domain.com \\\n --protocol mcp \\\n --endpoint agent.your-domain.com \\\n --backend akamai-edgedns\n ```\n\n4. **Use in Python**:\n ```python\n import asyncio\n from dns_aid.backends.akamai_edgedns import AkamaiEdgeDNSBackend\n from dns_aid import publish\n\n async def main():\n # Initialize backend (reads from ~/.edgerc or environment variables)\n backend = AkamaiEdgeDNSBackend()\n await publish(\n name=\"my-agent\",\n domain=\"your-domain.com\",\n protocol=\"mcp\",\n endpoint=\"agent.your-domain.com\",\n backend=backend,\n )\n\n asyncio.run(main())\n ```\n\n#### Akamai Edge DNS Features\n\n- **Native SVCB support**: Full RFC 9460 compliance including private-use keys \n- **Full DNS-AID compliance**: All custom params (`cap`, `bap`, `realm`, etc.) written natively on the SVCB record — no demotion to TXT\n- **DNSSEC**: Built-in zone signing via sign-and-serve\n- **Flexible credentials**: Supports both `.edgerc` file and environment variables\n\n## How DNS-AID Relates to Other Efforts\n\nAgent discovery is an active design space, with multiple proposals working at different layers of the stack. DNS-AID is intentionally narrow: it standardizes a DNS-layer substrate that publishers and resolvers can rely on, leaving directory, ranking, payments, and namespace policy to other efforts. The summary below is meant to help operators understand where DNS-AID fits — not to position it against other work.\n\n**Adjacent efforts**\n\n- **Agent Name Service (ANS)** — A directory-oriented approach defining a JSON metadata schema and registry interfaces. DNS-AID's HTTP Index format is intentionally aligned with the ANS schema where it overlaps, so an ANS-style directory can be served from the same data a DNS-AID publisher produces.\n- **A2A** — A communication protocol for agent-to-agent messaging. DNS-AID is complementary: A2A defines how two agents talk, DNS-AID defines how one agent finds the other's endpoint to talk to.\n- **AgentDNS** — A separate proposal that builds an agent-naming layer on top of DNS primitives. The two proposals overlap in spirit and differ in mechanism; DNS-AID's choice is to stay inside RFC 9460 SVCB so existing authoritative servers and resolvers work unchanged.\n- **NANDA** — A peer-to-peer overlay approach. Useful in deployments where a DHT-style substrate is preferred; DNS-AID instead targets the DNS infrastructure organizations already operate.\n- **ai.txt / llms.txt** — Free-form text files at well-known URLs. Useful for human-readable discovery; DNS-AID adds structured SVCB records and optional DNSSEC-validated trust.\n- **`.agent` gTLD** — An ICANN new-gTLD effort by the [Agent Community](https://agentcommunity.org/) to create a dedicated namespace (`mycompany.agent`). Complementary to DNS-AID — when `.agent` domains become available, DNS-AID records will work on them too, the same way they work on any other zone.\n\n**Where DNS-AID is scoped**\n\nDNS-AID standardizes the publish/resolve substrate: SVCB record layout, naming convention, capability and policy parameters, and a DNSSEC-anchored verification path. It does not pick a winning directory, ranking algorithm, payment system, or trust authority. Operators are free to combine DNS-AID with any of the efforts above, or to run it standalone.\n\n## Background and Comparison\n\nFor background on how DNS-AID compares to other agent-discovery approaches (ANS, Google A2A+UCP, `.agent` gTLD, AgentDNS, NANDA, Web3, `ai.txt`) and \"The Sovereignty Question\", see [docs/positioning.md](docs/positioning.md). That content is non-normative — protocol positioning is determined at the IETF.\n\n## Examples\n\nSee the `examples/` directory:\n\n- `demo_route53.py` - Basic Route 53 publish/discover\n- `demo_full.py` - Complete end-to-end demonstration\n\n```bash\n# Run the full demo\nexport DNS_AID_TEST_ZONE=\"your-zone.com\"\npython examples/demo_full.py\n```\n\n## Development\n\n```bash\n# Clone the repo\ngit clone https://github.com/dns-aid/dns-aid-core.git\ncd DNS-AID\n\n# Install all workspace packages (requires uv)\nuv sync\n\n# Run all tests\nuv run pytest\n\n# Run tests for a specific package\nuv run pytest packages/dns-aid-directory/tests/\nuv run pytest packages/dns-aid-crawlers/tests/\nuv run pytest packages/dns-aid-k8s/tests/\n\n# Run with coverage\nuv run pytest --cov=dns_aid_directory --cov=dns_aid_crawlers --cov=dns_aid_k8s\n```\n\n## Related Standards\n\n- [RFC 9460](https://www.rfc-editor.org/rfc/rfc9460.html) - SVCB and HTTPS Resource Records\n- [RFC 4033-4035](https://www.rfc-editor.org/rfc/rfc4033.html) - DNSSEC\n- [RFC 6698](https://www.rfc-editor.org/rfc/rfc6698.html) - DANE TLSA\n\n## License\n\nApache 2.0\n\n## Contributing\n\nContributions welcome! This project supports an implementation ecosystem with planned hosting in the Linux Foundation. The DNS-AID specification is developed in the IETF.\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n", "bytes": 49426, "sha": "6b50d75a2c81453cf9e11022b71c6e7737b242bd546ec62b67fb5b4412a53a55", "repo_slug": "infobloxopen/dns-aid-core", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_io_github_infobloxopen_dns_aid_cd81d8fc/readme" }