{
  "markdown": "# UUAID\n\n**The verifiable identity layer for AI agents — the SSL/CA for agents.**\n\nA permanent, portable identity plus encrypted, quantum-ready memory that outlives\nthe session. This monorepo holds the official TypeScript packages; the hosted\nregistry, resolver, and on-chain anchor run at [uuaid.org](https://uuaid.org).\n\nProtocol specifications live in [uuaid/spec](https://github.com/uuaid/spec).\nThe design argument, including the vulnerability we found in our own verifier,\nis at [uuaid.org/know-your-agent](https://uuaid.org/know-your-agent).\n\n## Packages\n\n| Package | npm | What |\n|---|---|---|\n| [`@uuaid/core`](packages/uuaid-core) | [`@uuaid/core`](https://npmjs.com/package/@uuaid/core) | UUAID grammar, JCS content hashing, crypto-agile signature envelope, Verifiable Badges (IAASO-0003) |\n| [`@uuaid/vault`](packages/vault) | [`@uuaid/vault`](https://npmjs.com/package/@uuaid/vault) | Client-side memory encryption (AES-256-GCM + hybrid X25519/ML-KEM-768) |\n| [`@uuaid/sdk`](packages/sdk) | [`@uuaid/sdk`](https://npmjs.com/package/@uuaid/sdk) | Typed client: signup, mint, save/recall memory, verify |\n| [`@uuaid/provenance`](packages/provenance) | [`@uuaid/provenance`](https://npmjs.com/package/@uuaid/provenance) | Media provenance (IAASO-0004) — bind an image, video or PDF to the agent that made it |\n| [`@uuaid/cli`](packages/cli) | [`@uuaid/cli`](https://npmjs.com/package/@uuaid/cli) | `uuaid signup · register · badge · verify-badge · vault …` |\n| [`@uuaid/mcp`](packages/mcp) | [`@uuaid/mcp`](https://npmjs.com/package/@uuaid/mcp) | MCP server — one config line makes any agent persistent |\n\n## Quickstart\n\n```bash\nnpx @uuaid/cli signup \"my-lab\"     # free API key, shown once\nnpx @uuaid/cli register \"ci-bot\"   # permanent ID\n```\n\n```ts\nimport { UuaidClient, generateVaultKey } from \"@uuaid/sdk\";\n\nconst { api_key } = await UuaidClient.signup(\"My Agent Lab\"); // free tier\nconst uuaid = new UuaidClient({ apiKey: api_key });\nconst { uuaid: id } = await uuaid.registerAgent({ display_name: \"Aria\" });\n```\n\n## Verifying a badge\n\nThe one thing to get right, so it is worth stating before the code: **a badge\nenvelope carries the signer's own public key.** Well-formedness, the payload-hash\nbind, signature validity, even a valid post-quantum signature — all of them pass\nfor a badge anybody minted with a fresh keypair and a copied `keyId`. Pinning the\nissuer against a published root is the only step that turns a valid signature\ninto an identity claim.\n\n`verifyBadge` therefore fails closed. No pin, no verdict.\n\n```ts\nimport { parseBadgeSvg, verifyBadge } from \"@uuaid/core\";\n\nconst { keys } = await fetch(\"https://api.uuaid.org/.well-known/uuaid-registry.json\").then(r => r.json());\nconst trustedIssuerKeys = Object.fromEntries(keys.map(k => [k.keyId, k.publicKey]));\n\nconst r = verifyBadge(parseBadgeSvg(svg), { trustedIssuerKeys });\nr.ok            // true only when the issuer pinned and the envelope is intact\nr.level         // \"L1-trusted\" | \"L0-selfsigned\" | \"invalid\" | …\nr.nameVerified  // did the registry vouch for the NAME on it? usually false\n```\n\nOmit `trustedIssuerKeys` and you get `ok: false`, `level: \"L0-selfsigned\"` — the\nlevel a forgery reaches. See\n[IAASO-0003 §4.3](https://github.com/uuaid/spec/blob/main/IAASO-0003-verifiable-badge-and-presentation-protocol.md#43-trust-root).\n\n## Development\n\n```bash\npnpm install\npnpm build && pnpm typecheck && pnpm test\n```\n\n## Security\n\nFound a badge that verifies and shouldn't? That is the most useful thing you can\nsend us — [security@uuaid.org](mailto:security@uuaid.org), and see\n[SECURITY.md](SECURITY.md).\n\nApache-2.0 — see [LICENSE](LICENSE).\n",
  "bytes": 3640,
  "sha": "f411c0862e6b4f0a622aae181ee490e63ff2c58501c609255d9f65e01a79ac01",
  "repo_slug": "uuaid/uuaid",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_uuaid_mcp_ab42f955/readme"
}