discoverLABSCO SUMMARY
Delegation and permission checks, not just key storage.
create_delegation plus check_permission is what separates this from a secret store: an orchestrator can grant a narrower scope to the agent it spawns, and that agent can ask whether an action is permitted before attempting it. Access tokens are short-lived, and the API key from quickstart is shown once.
What it is
An identity service for agents, reachable as an MCP server built into its API. It registers agents, issues and rotates credentials, exchanges them for short-lived access tokens, and records delegations between agents.
What you get
- quickstart — register a root agent and get its identity, API key, access token and refresh token in one call
- authenticate, refresh_token, introspect_token and revoke_token for the token lifecycle
- create_credential, rotate_credential and revoke_credential
- create_delegation and check_permission — one agent acting for another, and whether it is allowed to
- list_agents and get_agent
- discover — the supported grant types, available scopes, token lifetimes and endpoint URLs
Requirements
For the hosted service, point a client at https://agentauth.radi.pro/mcp and nothing else is needed. For local or self-hosted use, the package agentauth-mcp-server runs over stdio and requires AGENTAUTH_URL; AGENTAUTH_API_KEY is optional and can be passed per call instead.
Setup effort
Paste a URL — add the endpoint to your client
USE CASES
01
Standing up an agent identity from scratch
One call registers the agent and returns its key and token pair; save the key immediately because it is shown once.
02
Running work without a long-lived secret in memory
Exchange the stored key for a short access token, and refresh before it expires rather than after.
03
Letting one agent act for another, narrowly
Create the delegation with the scopes you intend, then have the acting agent check the permission before it moves.
04
Shutting an agent down cleanly
Revoke its tokens, rotate or revoke its credential, and confirm what is left with the agent listing.
13 tools
Listed in project docs. Your client may show a different list.
quickstartauthenticaterefresh_tokenintrospect_tokenrevoke_tokencreate_credentialrotate_credentialrevoke_credentialcreate_delegationcheck_permissionlist_agentsget_agentBEFORE YOU INSTALL
What to know first
Tools you get
13 tools named in the project's documentation.
Requires
A client that can reach a remote MCP server over HTTP
INSTALLATION
Connect your client
Add the endpoint to your client.
Server setup
ENDPOINT URL
https://agentauth.radi.pro/mcpMCP Clients
Claude Code
CLAUDE CODE · JSON
{
"mcpServers": {
"agentauth": {
"type": "http",
"url": "https://agentauth.radi.pro/mcp"
}
}
}Cursor, Continue
JSON
{
"mcpServers": {
"agentauth": {
"url": "https://agentauth.radi.pro/mcp"
}
}
}VS Code
VS CODE · JSON
{
"servers": {
"agentauth": {
"url": "https://agentauth.radi.pro/mcp"
}
}
}Windsurf
WINDSURF · JSON
{
"mcpServers": {
"agentauth": {
"serverUrl": "https://agentauth.radi.pro/mcp"
}
}
}Any MCP client — local stdio
ANY MCP CLIENT — LOCAL STDIO · TERMINAL
git clone https://github.com/raditotev/agent-auth.git
cd agent-auth/mcp-server
uv pip install -e .ANY MCP CLIENT — LOCAL STDIO · JSON
{
"mcpServers": {
"agentauth": {
"command": "uv",
"args": [
"run",
"--directory",
"<YOUR_PATH_TO_AGENT_AUTH_MCP_SERVER>",
"agentauth-mcp"
],
"env": {
"AGENTAUTH_URL": "https://agentauth.radi.pro"
}
}
}
}<YOUR_PATH_TO_AGENT_AUTH_MCP_SERVER> is the full path of the mcp-server folder in your clone. AGENTAUTH_URL points at the hosted service; set it to your own instance's address if you run one. AGENTAUTH_API_KEY is optional and can be passed on each call instead.
