Vouch Protocol

Vouch Protocol™

_{Vouch Protocol™ — common-law trademark.}

The Open Standard for Identity & Provenance of AI Agents

---

Quick Start

pip install vouch-protocol

# One command to configure SSH signing + Vouch branding
vouch git init

# All future commits are now signed and show ✅ Verified on GitHub
git commit -m "Secure commit"

---

What's New in v1.0

Vouch Protocol v1.0 aligns directly with the open standard:

• Verifiable Credentials as the credential format (replacing v0.x JWS tokens).
• Data Integrity proofs with the eddsa-jcs-2022 cryptosuite (no JOSE, no Base64-wrapped payload, the credential remains human-readable JSON).
• Multikey verification methods in DID Documents (algorithm-agnostic, ML-DSA-44 ready).
• Hybrid post-quantum profile (hybrid-eddsa-mldsa44-jcs-2026) as an optional add-on for regulated deployments aligning with NIST CNSA 2.0 / NSM-10 timelines.
• Three-way cross-implementation interop verified across Python, TypeScript, and Go.

The legacy v0.x JWS API (Signer.sign(), Verifier.verify()) continues to work unchanged for a deprecation window. New code should prefer Signer.sign_credential() and Verifier.verify_credential(). See the Specification at vouch-protocol.com/specs/SPEC/ for the full specification.

---

The Open Standard for AI Agent Identity & Accountability

When Anthropic launched MCP, they solved "how agents call tools." They didn't solve "how we TRUST those agents."

Vouch Protocol is the SSL certificate for AI agents.

Read the spec → | Join Discord →

---

The Problem

AI agents are making real-world API calls with ZERO cryptographic proof of:

• WHO they are
• WHAT they intended to do
• WHEN they did it

Examples of the risk:

• Healthcare AI accesses patient data → HIPAA violation risk
• Financial AI makes unauthorized trades → Liability nightmare
• Customer service AI leaks data → Compliance failure