CredentAgent

The consent layer for AI agents. Before an AI agent completes a consequential action — a payment, an age gate, an access grant — CredentAgent makes it prove a verifiable credential from the user's phone wallet. Identity leads; payments is one application — age.over(21), a loyalty membership, a prescription, and payment.in("usd") are all just credentials in the same policy.

Real, tested, and published on npm. Start with the quickstart — try it, run it, own it in ~5 minutes.

What it is

Agents are gaining the ability to act — to check out a cart, unlock age-restricted content, grant access. CredentAgent puts a human-in-the-loop credential check in front of that action: the agent mints a link, the user proves a credential from their wallet (WebAuthn passkey, or an OpenID4VP / W3C Digital Credentials presentation), and only then does the action complete. The check is enforced server-side on the completion path — hiding a button is not enforcement.

CredentAgent is two npm packages plus a reference demo. The Gate is host-agnostic — it mounts on any Express-shaped app. The Storefront is one ready-made host that shows the Gate in a full agentic-commerce flow; you can bring your own host instead.

The two packages

Package	One line	Install
@openmobilehub/credentagent-gate	The Gate — new CredentAgent() + credentagent.mount(app) wires the wallet-ceremony rails and resolves a typed credential policy into a serializable requires manifest.	npm install @openmobilehub/credentagent-gate
@openmobilehub/credentagent-storefront	The Storefront — createStorefront() stands up a runnable MCP shopping server (catalog-injected, ten tools, a widget) that the Gate mounts onto.	npm install @openmobilehub/credentagent-storefront @openmobilehub/credentagent-gate

Both are Apache-2.0, ESM, ship their own types, and target Node ≥ 20. The Gate stands alone on any Express host; the Storefront is the reference host that demos the whole flow.

Quickstart

Zero setup — try it now: paste https://credentagent.ai/marketplace/mcp into Claude / ChatGPT / Goose as a remote connector and ask it to sell you the whiskey — the age gate fires. (https://credentagent.ai/marketplace-dev/mcp runs main's unreleased build.) Then take the 5-minute quickstart (run it locally → deploy your own with one click).

A credential-gated agentic storefront in ≤ 10 lines. createStorefront() publishes the ceremony seams; new CredentAgent().mount(store.app) wires the real /credentagent/* rails; store.gate() resolves your policy on every checkout call (payment settles last):

import { createStorefront } from "@openmobilehub/credentagent-storefront/server";
import { CredentAgent, age, membership, payment, required, optional } from "@openmobilehub/credentagent-gate";

const store = createStorefront();                  // the storefront — one line
const credentagent = new CredentAgent();                     // zero-config (defaults to http://localhost:3000)
credentagent.mount(store.app);                          // wires the real /credentagent/* ceremony rails

store.gate((order) =>                              // resolved on every checkout
  credentagent.requirements(order, [
    required(age.over(21).when((order) => order.lines.some((l) => l.minimumAge != null))),
    optional(membership.discount(10)),              // 10% off if a loyalty credential is presented
    required(payment.in("usd")),                    // amount derived from the order; settles last
  ]),
);

const { url } = await store.listen(3005);          // → add http://localhost:3005/mcp to Claude / ChatGPT / Goose

Add the whiskey (21+) to the cart and check out → the tool returns the checkout link plus a requires manifest → the buyer proves age (and optionally membership), authorizes payment, and the widget shows the confirmation. Add the headphones instead and the age gate drops — the .when() predicate receives the order and is false.

For a deployment, pass your public origin: new CredentAgent({ walletOrigin: "https://shop.example" }).

Documentation

• Reference (docs/reference/):
  • API reference — every public export of both packages (CredentAgent, requirements, mount, the credential builders, defineCredential / dcql, createStorefront).
  • Getting started — install + the ~10-line quickstart.
  • The three execution contexts — tool mints → page runs → poll reports.
  • Trust model — what binds cryptographically per rail, honestly.
• ARCHITECTURE.md — the ceremony rails, the mount() injected-seam contract, the code→data boundary, and how the two packages compose.
• SECURITY-INVARIANTS.md — the six load-bearing rules (enforce server-side on every completion path, never trust the order token, scope state per order/session, require explicit positive credential claims, keep WebAuthn / OpenID4VP origin-bound with replay protection).
• SECURITY.md — how to report a vulnerability privately, the supported versions, and what is already known (presence-only / device-signed trust).
• CONTRIBUTING.md — DCO sign-off (git commit -s), the security-bypass testing bar, and the module conventions.
• docs/deployment.md — running it for real (serverless stores, the stable signing key, the settle seam) + a troubleshooting table.
• ROADMAP.md — what has shipped vs. what's next (Mode B page-less gating, issuer-verified trust).

Honest status

Honesty is core to CredentAgent — it's infrastructure meant to be trusted, so we name what binds cryptographically and what doesn't.

trust_level: "presence-only-demo" on the built-in checkout rails (passkey, credential, dc-payment). The wire cryptography is real — WebAuthn on the passkey rail (verified against this server's origin / RP-ID, user-verification required, nonce/replay-bound), OpenID4VP JWE / ECDH-ES decrypt with nonce binding, HPKE, ISO-mdoc parse. But there is no issuer / device-signature trust anchor yet: the gate enforces disclosure (an explicit positive claim such as age_over_21 === true, never mere token-presence) and binding (nonce / ephemeral key), but not trust. A self-crafted mdoc would pass. The checkout Payment Mandate is dev-signed (integrity hash), not key-signed.

trust_level: "device-signed" on device-signed spending grants. The gate verifies the wallet's real signature over the grant's exact terms, but the credential's trust anchor is still a self-minted demo credential, not a CA — a self-crafted credential would pass too.

trustLevel: "server-issued-demo" on click-approved page-mode grants and DelegatedGate. No credential at all — the server takes the human's word for it. For demos, examples and CI only.

This is a flow demo, not a real safety control — never present it as one. Issuer-verified cryptographic mdoc trust (issuer MSO + device signatures, via Multipaz / @auth0/mdl, trust_level: "issuer-verified") is planned work, not shipped. The gate never reports "issuer-verified" itself; only an external verifier plugged into the delegated seam may.

The honesty is carried in the types, not just prose: trust_level and enforcedAt are part of the contract. See SECURITY-INVARIANTS.md and the Gate's honest status for the per-rail breakdown. To report a vulnerability, follow SECURITY.md — privately, never in a public issue.

Reference demo

The runnable reference is examples/quickstart — a thin consumer of the published packages you can try hosted, run locally, or deploy your own in ~5 minutes. It demonstrates the full browse → cart → credential gate → checkout → settlement flow, including the passkey (same-device + cross-device caBLE) and Digital-Credentials payment rails and an x402 → Hedera on-chain settlement lab.

To see both packages in a real deployment, look at the Utopia Marketplace MCP server: an AI agent shops its catalog, and verification and settlement are delegated to Multipaz and UPay through the gate's verifier seam.

License & project

Apache-2.0. See LICENSE.

CredentAgent is an Open Mobile Hub project (a Linux Foundation / OpenWallet Foundation effort), built in collaboration with the Multipaz team, and heading to the Global Digital Collaboration (GDC) event.