IdentaBar is the official reference implementation for verifying AI agent identities using the Creduent Open Protocol. Created and developed by IDevSec.
Creduent is the canonical open application-layer protocol for cryptographic identity and trust verification of autonomous AI agents, originally created by Kashish Kanojia and stewarded by IDevSec.
IdentaBar secures both browser sessions and local development environments through two dedicated clients.
This repository is organized as a monorepo:
The core cryptographic verification module shared between both clients. Contains JCS canonicalization, Ed25519 signature validation, and registry attestation retrieval logic.
Run node sync-shared.js at the root to sync the module. In local development, it creates directory junctions or symlinks for hot-reloading. In CI and production builds, it performs a recursive file copy.
A Manifest V3 web extension for Google Chrome, Microsoft Edge, Brave, Opera, and Mozilla Firefox (109+).
Automatically scans visited domains for agent identity configurations, resolves attestation records from the registry, and displays real-time trust badges in the browser toolbar. Includes a DevTools verification playground.
Available on: Mozilla Add-ons | Chrome Web Store (pending review) | Microsoft Edge Add-ons (pending review)
A desktop integration extension for Visual Studio Code and VSCodium.
Scans workspace folders for agent.json files, performs local Ed25519 signature verification, and displays trust status in the status bar. Provides a multi-section sidebar with four views: Workspace Agents, Detected Frameworks, Registries, and Help and Feedback. Enables one-click keypair generation and live agent registration directly to the Creduent registry from inside the IDE.
Available on: Visual Studio Marketplace | Open VSX Registry
Both clients follow the same zero-dependency cryptographic verification process:
- Resolution: Detects agent metadata declarations via
agent.jsonfiles or.well-known/agent.jsondiscovery. - Registry Fetch: Connects to the resolver at
https://creduent.idevsec.comto retrieve the agent's JCS attestation record. - Local Validation: Verifies the document signature locally using the native Web Crypto API in browsers or the native
cryptomodule in VS Code. No data leaves the client. - Enforcement: Validates revocation status and expiration timestamps (
valid_until/expires_at) and updates trust indicators accordingly.
- Browsers: Firefox 109+ (live), Chrome and Edge (under store review), Brave, Opera
- IDEs: VS Code and VSCodium (v1.74.0 and above)
- License: Apache 2.0 (includes patent grant)
- Cryptography: Ed25519 signatures
- Canonicalization: JSON Canonicalization Scheme - RFC 8785
- Key Storage: 0o600 owner-only file permissions for private keys
- Network: 5-second timeout on all outbound registry requests
- Verification: 100% client-side - no telemetry, no data collection
Apache 2.0 - See the LICENSE file for the full legal text.
Copyright 2026 IDevSec