Your AI acts for you. It never becomes you.
ID MCP is an open identity layer for AI agents: one identity you own, limited permissions you grant, and a signed record of everything they do.
How it works
Four steps between you and any AI you use, in Claude, GPT, Gemini or anything that speaks MCP.
You hold the root key
Created from a seed phrase and kept away from the machine where the AI runs.
You grant a permission
A delegation names the scopes, the service and the expiry. One hour, one task, one site.
The AI gets a sub-key
It can only act inside that delegation. Every request is written to a signed log first.
The service verifies
Signature, scope, audience, freshness and revocation are checked. You can cancel any time.
Built for the agent era
Today each AI tool locks you into its own account. This is a different model.
You own the identity
No email, no phone number, no platform that can delete you. The identity is a key you hold.
Scoped and short-lived
Permissions are named, bound to a service and expire within 24 hours by policy.
Revocable
Signed revocations cancel a delegation. A broken revocation list stops signing instead of being ignored.
Audit trail
Each signing request lands in a hash-chained log before anything is signed. If logging fails, nothing is signed.
Hybrid post-quantum
Ed25519 together with ML-DSA. Both signatures must verify, so one broken algorithm is not enough.
Made for MCP and A2A
An identity layer for the agent protocols that already exist, not a replacement for them.
What an AI can and cannot do
Designed so a compromised agent has a small, time-limited blast radius.
It can
- Sign a request inside the scopes you granted
- Prove who it is acting for
- Ask you for more permission
It cannot
- Sign arbitrary data
- Approve its own permission request
- Outlive the expiry you set or ignore a revocation
Known limits
What ID MCP does not protect you from. We would rather say it plainly.
- Your AI provider still sees your conversation. A model has to read text to use it. ID MCP keeps your keys away from the model, not your words.
- Tool results enter the model's context, including identifiers. Separate pseudonymous IDs per service, so services and providers cannot link you, are planned and not built yet.
- Prompt injection can misuse a permission you granted. Scopes and expiry limit the damage; they do not prevent it.
- Approving without reading defeats any approval step.
- Typing recovery words on an infected computer can leak them. Use the recovery phrase only to restore, never for daily use.
- The ML-DSA library is not independently audited, and signed timestamps are self-asserted until a third party anchors them. This is a prototype.
Status
Open and early.