# mdip-agent-kit

> Starter kit that gives an AI agent its own did:mdip identity (Keychain MDIP, hyperswarm registry, the network used by the SELF identity app): local encrypted keymaster wallet, agent DID, SELF Public Profile credential (published+revealed), recovery-phrase network backup + local encrypted backup with restore test, plus helpers to sign/verify JSON, create/answer/verify challenges, and accept/check delegated-authority credentials.

## Docs
- [README.md](README.md): what/why, quickstart, config, gatekeeper options, backups, security, troubleshooting
- [AGENTS.md](AGENTS.md): step-by-step self-install procedure for AI agents
- [examples/agent-handshake.js](examples/agent-handshake.js): challenge/response between agents
- [examples/purchase-authorization.js](examples/purchase-authorization.js): accept and check a human-issued purchase credential
- [vectors/README.md](vectors/README.md): known-answer vectors (stock OpenSSL, no install)
- [CHANGELOG.md](CHANGELOG.md): changes per version

- [README.md#known-answer-vectors-verify-with-stock-openssl-no-install](README.md): install-free known-answer vectors (secp256k1 / sha256(JCS)); files in vectors/, run `bash vectors/verify-openssl.sh`; needs only bash 3.2+ + OpenSSL >= 3.0 (macOS: set OPENSSL to Homebrew openssl@3); includes mdip-challenge-2 (offline challenge<->response binding via a PUBLIC TEST verifier key, stock-OpenSSL decrypt), an expiry table (response.validUntil <= challenge.validUntil + 2 h, stock keymaster skew allowed; strict RFC 3339, compared to the nanosecond, same in bash and JS) and test/vectors-negative.sh (mutation test); both checkers pin the known answers and all DIDs, require low-S signatures, enforce a strict SHA256SUMS format, and compare every human-readable .json (JCS key order) and PEM exactly to the signed/derived bytes

## Key facts
- Install: `npm install mdip-agent-kit`; CLI: `npx mdip-agent-kit init --profile-name "Name"`; config via MDIP_HOME, MDIP_GATEKEEPER_URL, MDIP_AGENT_NAME
- DID prefix did:mdip, registry hyperswarm (NOT the Keychain sample default did:test)
- SELF Public Profile schema DID: did:mdip:z3v8AuagfG89zr9aGxfxub4wRAd15qJs6u9C5jQPgrqC1YRHF67 (field: publicName)
- Public check: https://explorer.selfid.com/api/did/<did>
- Gatekeeper: run your own via scripts/run-local-node.sh (official KeychainMDIP/kc compose). No public write gatekeeper is offered; verify publication via https://explorer.selfid.com/api/did/<did>
- Verify a challenge response with `verifyResponse(responseDid, { challenge })` / `mdip-agent verify-response <responseDid> --challenge <challengeDid>`; act only on match === true (reasons in .checks); a response copied into another controller's asset is rejected
- Check delegated authority with `findCredentials({ schema, issuer })` right before acting (only valid, unrevoked credentials about this agent, signed by that issuer)
- Secrets: $MDIP_HOME/secrets (mode 600); never print them

## Upstream
- [Keychain MDIP](https://keychain.org/docs/), [KeychainMDIP/kc](https://github.com/KeychainMDIP/kc)
- [SELF developer docs](https://docs.selfid.com)
