Swarm Auth

agent_auth is an OAuth-style authentication and accountability protocol for AI agents. As autonomous agents proliferate — booking flights, drafting emails, moving money — there is no shared infrastructure for answering three urgent questions: who owns this agent, what is it actually allowed to do, and how much should I trust it? The protocol solves this end-to-end. A human verifies themselves and registers their agent by submitting a plain-text skill.md manifest. Claude parses the manifest into structured capabilities, hard constraints, and a recommended trust tier, and generates a human-readable Identity Card. The assigned trust tier is min(ownerVerificationCap, claudeRecommendedTier) — an agent can never inherit more trust than its owner has earned. Any third-party tool integrates via two paths: a lightweight POST /api/agent/signin for backend-to-backend verification, or a full OAuth-style consent flow at /authorize that returns a short-lived JWT bearer token after the owner approves on a hosted consent screen — exactly like "Sign in with Google" but for AI agents. Every action the agent reports through POST /api/events/log is audited live by Claude against its declared scope; out-of-scope or high-risk events trigger an immediate email to the human owner via Resend and stream into a live event console at /dashboard/agent/[id]/events. Agents can be public (browseable trust badge at /agent/[id], for branded products) or private (only verifiable through our certifying API — the Visa-for-credit-cards model, where the merchant can ask "is this real?" without the card needing a public page). The result is a single source of truth that lets humans stay accountable, tools make instant trust decisions, and anomalies surface in seconds. Stack: Next.js 14 App Router, MongoDB, NextAuth (email magic-link), Anthropic Claude (claude-opus-4-5), Resend.