AgentStamp is an identity and reputation certification service for AI agents on the open web. Its core goal is to enable two agents from different organizations to verify each other's identity and reputation before a transaction, so they can interact securely. It emphasizes "verify before serving," that is, before responding to an agent it has never seen before, first check its trust score.
Main capabilities
- Cryptographic identity: Uses Ed25519-signed certificates to prove an agent's existence, verifiable by anyone and tamper-proof.
- Reputation scoring: Calculates a reputation score from 0-100 based on endorsements, uptime, age, and tier, accumulating over time.
- Trust score decay: Silent agents lose trust, with a 3-day grace period and tiered multipliers; trust must be continuously maintained.
- Cold-start incentives: New agents can each earn a 3-point reward through 5 onboarding actions, building trust faster.
- Trust delegation: Agents with established reputation (50+) can vouch for newcomers, capped at 20 points, single-hop, expiring after 30 days.
- Blind verification: Uses HMAC-SHA256 tokens to verify a stamp without exposing the wallet.
- Forensic audit chain: An append-only, hash-chained event log that links events with SHA-256 and includes Ed25519 signatures, making it tamper-proof.
- Reputation alerts: Triggers Webhook alerts when the trust score changes by more than 5 points.
- ERC-8004 reputation layer: Adds free zero-gas reputation adjudication on top of on-chain identity.
- Multi-chain wallets: Links EVM and Solana wallets through dual-signature proof to prevent hijacking.
- Request body binding signature: Binds the SHA-256 request body hash into the signature to prevent replay and tampering.
- Google A2A-compatible signed passport: A portable agent identity containing trust score, stamp, and wallet links.
- EU AI Act compliance: Structured compliance reports with risk classification, transparency statements, and audit summaries, prepared for the August 2026 deadline.
- W3C verifiable credentials: Exports agent identity as a W3C VC, which any verifier can check without calling an API.
- Key rotation and revocation: Rotate signing keys without losing identity, instantly revoke compromised keys, and receive Webhook notifications for lifecycle events.
- Accountability: Links each agent to the responsible human, meeting compliance teams' audit trail and incident response needs.
- Claude Desktop integration: Performs trust checks, blind verification, forensic auditing, registry browsing, andreputation queries through an MCP client.
How to use Provides a REST API, MCP tools, TypeScript SDK, Webhooks, and embeddable badges, and claims it can be integrated in minutes. Registration is free, with no credit card, API key, or account registration required, and the SDK is published on npm and PyPI. Authentication is done through x402 with a very small payment, with no account needed. The process is: obtain cryptographic stamp certification, join the decentralized registry, send heartbeats and earn endorsements and delegations to grow reputation, and anyone can check the trust score through blind verification, SDK middleware, or direct API queries.
Use cases Suitable for interoperability between agents from different organizations on the open web and pre-transaction trust verification, as well as scenarios requiring audit trails, compliance reports, and portable identity credentials.
Limitations AgentStamp is positioned as external agent certification for the open web, not an enterprise-internal agent governance platform, and it does not replace tools such as CrowdStrike/Ceros, but works with them to achieve full-stack agent security. It does not provide runtime or perimeter security (such as prompt injection defense, device-bound keys, or per-operation authorization). Specific implementation details and availability for some features, such as EU AI Act compliance reports, W3C VC export, and key rotation, are not yet provided. Specific limits of the free tier are not yet provided.
