Our take
Maintaineda few commits in the last 90 days- Activity
- 33
- Community
- 4
- Issues
- 21
- Pull requests
- 63
+0 stars in the last 30 days
- Fewer contributors than 91% of the projects we track
OAP offers a focused draft standard and supporting conformance materials, but adoption means building on a specification maintained by a single contributor with no recent releases.
Good fit if
- Your team is designing runtime authorization for AI agents and wants a defined passport and decision format.
- You need guidance for signed authorization records or interoperability with Verifiable Credentials.
- You are prepared to evaluate and implement a working draft; the repository has recent activity, but all recorded contributor activity is concentrated in one person.
Look elsewhere if
- You need a mature, released standard with a broader contributor base.
- You need a ready-to-deploy authorization service or SDK rather than a specification and its supporting tools.
- You cannot accept the uncertainty of a draft specification or a project with no releases in the past year.
All health signals
| Last commit | 2026-10-12 (9 days ago) |
|---|---|
| Commits, last 90 days | 7 |
| Releases, last 12 months | 0 |
| Contributors | 1 |
| Issues closed, last 90 days | 0 |
| Pull requests merged, last 90 days | 7 (typically merged in 0 days) |
| Project age | 13 months |
Checked on 2026-10-22 with the GitHub API.
Project history
Daily GitHub snapshots since Oct 7, 2026. History covers stars and forks; health signals are not tracked historically.
Stars
4Forks
0Change since Nov 12, 2026: 0 stars·0 forks
Overview
aport-spec defines Open Agent Passport (OAP) v1.0, a draft specification for AI agent passports and pre-action authorization. It addresses the gap between verifying who created an agent and checking what that agent is permitted to do at the moment it attempts a sensitive operation.
The repository is for platform builders and developers designing agent identity and authorization systems. It provides schemas, policy guidance, examples, and conformance materials intended to support signed decisions, audit records, and interoperability with W3C Verifiable Credentials.
Key Features
- Passport and decision schemas for representing agent identity, capabilities, and authorization outcomes.
- A capability registry and conformance requirements for consistent policy evaluation.
- A security model covering cryptographic verification, including Ed25519 signature validation in the stated conformance coverage.
- Service discovery guidance for
.well-known/oap/endpoints. - Example passports and allow/deny decisions to illustrate the data formats.
- W3C Verifiable Credentials context, mapping guidance, and conversion tools.
- A conformance runner and test cases covering schemas, policy evaluation, signatures, and performance.
Use Cases
- A commerce platform can evaluate an agent's permissions before allowing it to move money or access sensitive data.
- An agent developer can describe an agent's identity and capabilities in a passport format for platforms to assess.
- A platform team can record signed authorization decisions for later auditing.
- A team adopting Verifiable Credentials can use the mapping guidance to connect OAP objects with VC formats.
- Implementers can run the conformance materials to check schema, policy, and signature behavior against the draft specification.
What you need
Detected in the repository
- TypeScript (main language on GitHub)
License in plain words
MITpermissive
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the copyright and license notice
- Share your changes: no
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
Start with the OAP v1.0 specification, then review the examples and conformance runner. See the repository README for the full document and tooling index.
Considerations
OAP v1.0 is explicitly marked as a draft, so its formats and requirements may change. The project is currently maintained, with recent commits and merged pull requests, but development is concentrated in one contributor and there have been no releases in over a year. The repository describes a specification, examples, and validation tooling; it does not establish that adopting teams receive a production authorization service. The README also presents sub-100ms decisions as a goal, not a measured result. No runtime, installation command, CI setup, or test setup is specified in the supplied project facts.
Found this useful?
Share it with someone who would like aport-spec.