What is clayseal-identity?

Clay Seal Identity gives AI agents, the automated programs that call tools and APIs on behalf of people or other services, a verifiable identity. Today many agents authenticate with something weak, like a shared password or a token that anyone who copies it could reuse. This project instead issues each agent a short lived, cryptographically signed credential that proves which agent is acting, who authorized it, and that the credential actually belongs to the agent presenting it, without needing to contact a central server every time to check. The credentials follow an existing open standard called SPIFFE, and come in two forms: signed tokens for general use, and certificates for a secure connection method called mTLS. Each credential is tied to a private key the agent holds, so a token that is stolen or copied on its own is not enough to impersonate the agent. The project also supports scoped API keys, so different parts of a system only get the narrow permissions they actually need instead of full access. This is described as the first of three layers the author is building. This first layer handles proving who an agent is. A second layer, still in limited early access, will handle granting and narrowing specific permissions over time. A third layer, released separately, produces verifiable records of what an agent actually did. This package works on its own and does not require the other two layers. The project includes a Python software development kit, an optional web service built with FastAPI for issuing and checking credentials, and support for both a simple local database and a production ready one. It also includes an example that shows how to lock down an MCP server, a common way AI tools are exposed to agents, so that only properly identified agents can call it, and each tool call is checked against what that agent is currently allowed to do. The README states clearly that this project focuses on identity and does not attempt to be a full security sandbox on its own.