Passport
Sign in

Identity tells you who an agent is. Passport decides what it can do.

Bounded permissions, a human above the line you draw, and a signed receipt for every decision.

Open dashboardHow it works
deploy:stagingAllowed
signature
valid
grant
deploy:staging · from main
policy
let it run
receipt
rcpt_01J4…

The record

One passport. Three sides.

How a decision is made.

One production promotion, proposal to receipt.

  1. An agent operating from a defined runtime identity.

    Agent proposes

    An LLM suggests promoting dpl_7f3a to production. It holds no key and can run nothing on its own.

  2. A tool request reaching a governed execution boundary.

    Runtime signs

    CI or a KMS turns the proposal into a signed request with a single-use nonce and a five-minute expiry.

  3. A release manager approving a bounded production action.

    Passport decides

    Signature, freshness, grant, limits, policy — in that order. Production is held for a named approver.

  4. A completed action leaving verifiable evidence behind.

    Receipt and audit

    The decision is signed and appended to a hash-linked log. Nothing runs without a receipt.

Not who the agent is. What it can touch.

The only claims we make are the ones you can check.

Ed25519
Every request and receipt is signed. Verify with a public key, not a vendor lookup.
≤ 5 min
A request lives five minutes and its nonce is single-use. Replays are refused.
0
Private keys a model ever sees. The LLM proposes; your runtime signs.

Read the source.

docs/protocol.md

Protocol

Envelope, signatures, receipts and the audit chain.

docs/threat-model.md

Threat model

What it defends against, and what it does not.

sdk/

SDK

Sign a request, submit it, verify the receipt. TypeScript.

examples/vercel-release-agent

Vercel release agent

A GitHub Actions agent that ships only what Passport allows.

docs/mcp-proxy.md

MCP proxy

Put Passport in front of any MCP server. Every tool call asks first.

npm run verify-audit

Verify an audit export

Re-check a whole audit chain offline, with one command.

Questions.

No. The model only proposes. The key lives in your CI runner, KMS or HSM, and signs after that runtime decides to submit. Passport then decides whether the action runs.

The request is held. A named approver sees the exact action and target, then approves or denies. Only an approved request gets a receipt, and only a receipt lets anything run.

Export the audit log. Each event is hash-linked to the last and the head is signed by the key at /.well-known/passport.json. One script checks the whole chain offline.

Vercel releases to staging and production. Any MCP tool call, through the proxy. Any HTTP API you register. Purchases are receipt-only: Passport decides, your system spends.

No. Identity systems say who an agent is. Passport sits after them and decides what it may do right now, under which limits, with whose approval.

Try a request yourself.