AgentLair × MPP Identity Bridge

A working prototype demonstrating verifiable agent identity for Machine Payments Protocol (MPP).

The Problem

MPP credentials have a source field — the agent's identity slot. It accepts DIDs (decentralized identifiers). But nobody verifies it.

The server checks: Was the challenge valid? Was the payment real? But "is this agent who they say they are?" — nobody asks. The source field is a sticky note, not a signature.

Stripe SPT payments don't even set source at all. Agents are completely anonymous.

Full technical breakdown →

The Bridge

AgentLair provides DID-based identity, Ed25519 keypairs, encrypted credential storage (Vault), and audit trails. This prototype connects AgentLair's identity stack to MPP's source field via cryptographic attestations.

Flow:

1. Agent registers with AgentLair → gets did:web:agentlair.dev:agents:<id>
2. On MPP payment, agent signs did|timestamp|challengeId with Ed25519 key
3. Attestation is embedded in the credential payload, DID goes in source
4. Server resolves the DID, verifies the signature, gets verified agent metadata
5. Policy decisions: premium pricing, access control, compliance, disputes

Demo

bun install
bun run src/demo.ts

Output:

Flow A — Without identity:
  No identity attestation in credential
  DID is present but NOT VERIFIED
  Result: { data: "Basic data for anonymous payment", identity: { verified: false } }

Flow B — With AgentLair identity:
  Agent identity VERIFIED:
    DID:    did:web:agentlair.dev:agents:agent-007
    Email:  [email protected] (verified: true)
    Score:  50/100
  Result: { data: "Premium data for verified agent", identity: { verified: true } }

Same protocol. Same payment. Different outcomes based on verifiable identity.

Structure

src/
  agentlair-identity.ts   # DID creation, Ed25519 signing, verification, Vault bridge
  demo.ts                  # End-to-end MPP server + client demo

What's Real

• Identity layer: Real Ed25519 cryptography, real DID resolution, real signature verification
• Timestamp freshness: 5-minute window enforced
• Payment layer: Mocked (no Tempo testnet funds needed) — payment is orthogonal to identity

What's Next

1. agentlair.dev/.well-known/did.json — DID Document endpoint
2. GET /v1/agents/{id}/identity — public DID resolution API
3. @agentlair/mpp-identity — NPM package (client attestation + server middleware)
4. mpp_pay_with_identity — MCP tool for Claude, GPT, and other agent frameworks

Dependencies

• mppx v0.4.9 — MPP SDK
• tweetnacl — Ed25519 signatures
• hono — lightweight server framework
• bun — runtime

License

MIT

Built by AgentLair — identity infrastructure for AI agents.