OAuth authorizes an application for a user and MCP connects a model to tools, but neither proves that this particular agent, acting for this particular person, is allowed to call delete. That is the gap here, and the tool manifest is the mechanism — a declared mapping from tool name to permission level, so an agent holding a write scope can create a record and still be refused when it reaches for a delete. Delegation is recorded with depth and parentage, which is what makes a chain of agents auditable rather than merely functional. Check the release-status notes before committing: several published packages carry documented gaps the maintainer states plainly.
An open-source delegated authorization protocol and reference implementation for AI agents: each agent gets a verifiable identity and a grant from a person or organisation, which a relying service can check before acting.
- Scoped, time-limited, revocable grants, so an agent's authority is bounded rather than inherited wholesale from a user's session
- Tool manifests that map each tool name to a permission level, so enforcement does not have to guess from the name
- A four-level permission hierarchy — read, write, delete, admin — where a higher scope subsumes the ones below it
- A scope format carrying connector, permission and resource, with an optional cap on the number of uses
- Multi-agent delegation with a recorded parent agent, parent grant and delegation depth
- Service-side verification through published JWKS, and audit records of what was authorized
- A trust registry for public DID verification, and a grantex verify CLI for inspecting a token with no account at all
- An MCP tool server package exposing Grantex to MCP clients, and an MCP authorization server package speaking OAuth 2.1 with PKCE
- Control mappings for the DPDP Act 2023 and the EU AI Act
- SDKs for TypeScript, Python and Go
A developer API key for the hosted service, or the reference implementation run yourself; the SDK you install depends on your language. Read the published-package limits before deploying: the Go SDK v0.1.10 has documented agent and audit read, write and filtering limitations, and the MCP authorization server 2.0.2 keeps authorization codes in process memory, does not render consent, and has an incomplete code handoff. Developer request budgets on the auth service run at 100, 500 and 2,000 requests per minute across the Free, Pro and Enterprise tiers.
One command plus a key — npm install @grantex/mcp, then supply credentials