Identity, scoped permission and audit are handled as three separate things here, which is what makes the record usable — a permission check reports the reason and the remaining quota rather than a bare no, and the audit export ships with a hash manifest so a third party can verify it. Trust verification is a public endpoint, so another party can check your agent without holding any credential of yours.
Vorim's server for agent identity and trust: agents get an Ed25519 keypair, permission scopes with quotas and expiry, hash-linked audit events, and a trust score anyone can check.
- Agent registration returning an identity — keypair, agent id and trust score — with the private key shown once, plus ephemeral agents on a did:key identity that expire on their own
- The agent roster: list with paging and status filters, read one agent's capabilities, permissions and metadata, update its details, or revoke it permanently, which zeroes its trust score
- Permissions as scopes: grant one with an expiry and a rate limit, list what is active, revoke it, and check whether an agent holds it — the check returns the reason for a denial and the remaining quota
- Audit events logged per action, and a signed export for a date range with a SHA-256 manifest so the bundle can be verified later
- Public trust verification that needs no authentication at all — score out of 100, status, active scopes and key details
- Credential delegation to an agent with its own rate limits and expiry, delegations listed per agent, and short-lived scoped access tokens issued for a named provider
- A device-authorization onboarding pair for users who have no key yet: start the flow, hand over the code and activation URL, then poll until the human approves
- A health check on the API and its services
A Vorim account, free to create, and an API key from Settings → API Keys carrying the agents, audit and trust scopes, passed as VORIM_API_KEY. Published on npm as @vorim/mcp-server and run over stdio; VORIM_BASE_URL points it at a different API host. The underlying protocol, VAIP, is MIT-licensed and has been submitted to the IETF.
One command plus a key — npm install -g @vorim/mcp-server, then supply credentials