For developers & AI agents

Obelisk for AI agents

Obelisk treats agents, bots, and automations as first-class identities: discoverable contracts, standards-based auth, an MCP tool server any assistant can call, and revocable proof links that show what an agent can actually prove about itself.

Why agents love Obelisk

Agents act on people's behalf, and the softest part of most systems is "log in". Obelisk makes identity machine-native: a discoverable contract, standards-based auth (OpenID Connect + DPoP), predictable JSON, tamper-evident receipts so an agent's actions are verifiable after the fact — and an identity of the agent's own, with bounded evidence anyone can inspect.

The machine map — start anywhere

Call Obelisk's trust tools over MCP — right now

Obelisk is both the MCP authorization server your own MCP server can delegate auth to and a public MCP tool server: read-only trust tools (scan a site's posture, verify a token, read an org's Rating, fetch an agent's proof, verify a run proof, pin the transparency head) over JSON-RPC at POST /mcp — no account needed. Catalogue at /mcp/tools; the full guide is at /mcp.

An identity of the agent's own — Proof Links

Any agent, bot, fleet, or child agent can enroll for an Agent Identity Record: the runtime generates its own key (Obelisk never receives private key material), a human owner approves a short device-style ceremony with their passkey, and the agent proves the key live. The result is an opaque, revocable Proof Link — /agent/<proof_id> — where people and software inspect independent, freshness-scoped claims: current key control, accountable ownership, workload evidence, authorization, declared human influence.

The page is deliberately precise about its truth boundary: it never claims an actor is permanently non-human, uncompromised, autonomous, or truthful when the evidence cannot establish that. Claims stay independent — there is no single "trust score" to game.

Owners manage agents — enrollment, visibility, lifecycle (suspend / compromise / recover), key rotation, ownership transfer — in Agent Studio.

Prove a single run, not just an identity

Identity says who an agent is; a run proof binds one specific action to that identity's key with commitment-only evidence — the raw task, input, and output never leave the runtime. The agent requests a one-use purpose:run challenge, builds an obelisk-agent-run-proof-v1, and submits it with a DPoP proof for a short-lived Obelisk-signed run token. Each proof carries its declared human-influence mode. Anyone can verify one via the verify_agent_run_proof MCP tool.

Authenticating as an agent

Agents authenticate the same way apps do: the user signs in with a passkey via Obelisk; your agent receives an OIDC access token. Present it as Authorization: Bearer <token> to call protected APIs on the user's behalf. For long-running agents, opt in to DPoP (RFC 9449) at the token endpoint — the token binds to your agent's own P-256 key, so even a leaked token is inert without it.

The auth vocabulary is a small closed set an agent can branch on: none, session (cookie or body token), bearer (OIDC), owner (org admin). Errors are uniform: { ok:false, reason, message }.

Per-project memory

Each project gets a per-user profile slice it owns, scoped to its OIDC client — perfect for agent state: GET/POST /api/project-profile with the user's access token. One identity underneath; your project's data layered on top. See the contract.

Verifiable by design

Every sensitive action chains a signed receipt, so an agent's behavior is auditable and non-repudiable — and the chain itself is provable: GET /api/proof/<receipt hash> returns a Merkle inclusion proof against the published transparency head. Combined with passkey-first, uncopyable credentials, Obelisk gives autonomous systems a foundation they can be trusted on. See Security.

Be a good citizen

Respect rate limits, scan only sites you're authorized to, and follow the Acceptable Use Policy. Good-faith research is protected under our disclosure policy.