Introducing GrokingClawID: Post-Quantum Identity for AI Agents
500,000 lines of defensive code in modern agent harnesses. Zero lines of cryptographic identity. We built the missing piece.
Zero dependencies at runtime.
The Problem Nobody's Solving
Every major agent framework — LangChain, CrewAI, AutoGen, Claude Code, Codex — has the same blind spot: agents can't prove who they are.
When your agent calls an API, who's signing the request? When two agents collaborate via MCP or A2A, how does either side know the other is legitimate? When an agent writes code, submits a PR, or triggers a deployment, what ties that action to a verified identity?
The answer today is: nothing. API keys. Environment variables. Bearer tokens that any process on the machine can read. That's not identity — that's a Post-it note.
This matters now because agents aren't staying in sandboxes. They're writing production code, managing infrastructure, handling money, and talking to each other. The NIST NCCoE is actively soliciting solutions for AI agent identity and authorization. The gap is real and the window is closing.
What GrokingClawID Does
GrokingClawID creates, manages, and verifies unforgeable cryptographic identities for AI agents. One command gives an agent an identity it can prove is real — to other agents, to APIs, to humans.
That's it. No SDK. No cloud service. No Docker container. A single static binary that works on any machine with a filesystem.
What's in the Box
| Feature | What it does |
|---|---|
| Post-quantum crypto | Ed25519 + ML-DSA-65 (FIPS 204) hybrid — both signatures must validate. Quantum-resistant today, not "eventually." |
| Agent identity cards | A2A-compatible JSON cards with SPIFFE IDs, scoped permissions, and expiration. Machine-readable trust. |
| Key rotation | New keypair, re-signed card, old key archived. Zero-downtime identity refresh. |
| Revocation | Permanent invalidation with a signed revocation registry. Can't un-revoke. |
| Delegation chains | Scope-narrowing, time-bounded authority transfer. Agent A grants Agent B a subset of its permissions. |
| MCP auth guard | Wrap any MCP tool server with identity enforcement. One command: grokingclawid guard. |
| HTTP signatures | RFC 9421 request signing with both classical and PQ signatures. |
| Challenge-response | Mutual authentication without shared secrets. Prove you hold the key. |
| A2A protocol | Google A2A JSON-RPC 2.0 server — agent discovery, task lifecycle, PQ-verified. |
| Audit log | Hash-chained, signed, tamper-evident. Every identity operation recorded. |
| IOTA wallet | Same Ed25519 key → IOTA address. Agent-to-agent payments on the same identity. |
| Agent daemon | Host process with mesh networking, birth protocol, sidecar proxies, Merkle anchoring. |
Architecture: Four Crates
The core library is the foundation. The CLI is for humans and scripts. The proxy sits between an agent and the network, enforcing identity at the infrastructure level — the agent doesn't need to know about crypto. The daemon manages fleets.
Why Hybrid Post-Quantum
Ed25519 is fast, battle-tested, and universally supported. ML-DSA-65 (formerly Dilithium, standardized as FIPS 204 in August 2024) is quantum-resistant.
We don't make you choose. Every GrokingClawID signature includes both. Both must validate. If Ed25519 breaks tomorrow (it won't soon, but planning is free), the ML-DSA signature still holds. If ML-DSA has a flaw discovered, Ed25519 still holds. Belt and suspenders.
The Daemon: Agent Birth Protocol
The CLI handles individual identities. The daemon manages the lifecycle.
Each agent gets its own identity, its own sidecar proxy (so identity enforcement happens at the network layer, not in agent code), and its own entry in the A2A discovery endpoint. The daemon supervises, restarts on failure, and anchors Merkle roots of agent activity to IOTA for tamper evidence.
MCP Auth Guard: Retrofit Identity onto Any Tool
Most MCP tool servers have no authentication. grokingclawid guard wraps any stdio-based MCP server with ClawID verification:
No code changes to the MCP server. No SDK integration. Just put the guard in front.
Security Audit
We ran a full security audit before release. 26 source files, ~8,600 lines of Rust.
| Severity | Found | Status |
|---|---|---|
| Critical | 0 | — |
| High | 5 | All fixed |
| Medium | 7 | All fixed |
| Low | 7 | Cosmetic — tracked |
Cryptographic foundations confirmed sound: hybrid "both must pass" logic correct, OsRng for key generation, no timing oracles in ed25519-dalek. Six unsafe blocks total across three files — all standard Unix patterns (libc::kill, signal handling, FFI boundaries). Private key files written with 0600 permissions enforced.
The audit results are in the CHANGELOG. We believe in showing your work.
E2E: 12 Steps, 33 Assertions, One Script
Don't trust our test count. Run the lab yourself:
Identity → template → birth → A2A → challenge → rotation → revocation → audit. The full lifecycle in a few minutes.
What This Isn't
Honest boundaries matter more than feature lists:
- Not a CA. We don't run a certificate authority. Identities are self-issued or issued by your daemon. You own your trust roots.
- Not an authorization framework. We handle identity (who are you?) and authentication (prove it). Authorization (what can you do?) is scoped in the card, but enforcement is your layer.
- Not cloud-hosted. There's no GrokingClaw SaaS. The binary runs on your machine, air-gapped if you want. We'll never see your keys.
- Not production-hardened for massive scale. A2A task storage is in-memory. Daemon mesh is abstracted but not battle-tested at many agents. We're honest about where we are.
Why Now
Three things converged:
- NIST is asking. The NCCoE published an open call for AI agent identity solutions. We submitted a public comment on April 1, offering GrokingClawID as a reference implementation. The regulatory window is open now.
- A2A and MCP are real. Google's Agent-to-Agent protocol and Anthropic's Model Context Protocol give agents standard ways to communicate. But neither specifies how agents identify themselves cryptographically. We fill that gap.
- FIPS 204 is final. ML-DSA was standardized in August 2024. Post-quantum crypto is no longer experimental — it's a NIST standard. Building on it today is responsible engineering, not speculation.