chancery

README

Chancery

The identity provider for AI agents — the neutral, self-hosted system of record for what every agent is, who it acts for, what it can do, and what it has done.

Agents get their identities from Chancery, their credentials through it (never holding real secrets), and every action attributed by it — by construction, not log forensics. In-path enforcement: register, scope, delegate, revoke — instantly, at the identity or instance level. Audit is metadata-only as a structural invariant: prompts and payloads are never stored.

Single Go binary. Apache-2.0. MCP-first, then HTTP, shell, browser. Try the 60-second story: make demo.

Two promises (RFC-011): what ships open source stays Apache-2.0 — no license flip, ever; and security is never paywalled — every gap in SECURITY.md closes in the open core. The boundary test: whatever makes a single trust domain secure and operable is open source; value that exists only at organizational scale (SSO/SCIM, multi-tenancy, SIEM exporters, compliance packs, HA orchestration) is enterprise.

Install

brew install chanceryhq/tap/chancery          # macOS / Linux
# or: docker run --rm -v chancery:/data ghcr.io/chanceryhq/chancery --help
# or: download a signed binary from the Releases page
# or from source:
go build -o chancery ./cmd/chancery

Release binaries and checksums are cosign-signed (keyless, via GitHub OIDC) and ship with an SBOM; verification instructions are in each release's notes.

Try it (pre-alpha)

./chancery init --trust-domain acme.com
./chancery agent register deploy-bot --owner user:you@acme.com \
    --purpose "deploys services" --prompt ./prompt.md --model claude-fable-5
./chancery writ grant --for user:you@acme.com --to deploy-bot --cap "call:github/*"
./chancery writ delegate <writ-id> --to test-runner --caveat "call:github/get_*"
./chancery writ check <writ-id> --resource github/get_pull_request   # ALLOW + lineage
./chancery writ revoke <writ-id>
./chancery writ check <writ-id> --resource github/get_pull_request   # DENY: revoked
./chancery audit                                                     # the timeline

Every action is attributed to a specific agent, version, and delegation chain — and a delegated writ can only ever narrow: the block format has no field for widening.

Enforce it live on any stdio MCP server (per-call policy, sealed secrets injected server-side only, revocation on the next call):

./chancery secret put github-token --from-file ./token
./chancery mcp wrap --agent deploy-bot --writ <writ-id> \
    --secret GITHUB_TOKEN=github-token -- npx @yourorg/some-mcp-server

Run the control plane as an HTTP API with ./chancery serve (REST/JSON under /v1; the admin token is printed once at init). The audit timeline is hash-chained — ./chancery audit verify detects any edit, deletion, or reorder. Known MVP gaps are published in RFC-009 §5.

Guides

• Quickstart — govern the real filesystem MCP server in 5 minutes
• Concepts — agent, version, instance, writ
• Claude Code / MCP client setup — the .mcp.json drop-in
• Go SDK and example agent — advisory in-process checks over the API
• LangGraph / Python agents — the deployment-shaped integration

The SDK is advisory — a client-side convenience. The enforcement boundary is always the out-of-process proxy (chancery mcp wrap), which a prompt-injected agent cannot talk its way around.

Design RFCs

Design happens as a series of locked decisions, one RFC at a time (template).

RFC	Title	Status
000	Vision and plan	In Review
001	Agent identity model	In Review
002	Lineage and delegation	In Review
003	Credential broker	In Review
004	Policy and authorization	In Review
005	Runtime enforcement (MCP → HTTP → shell → browser)	In Review
006	Audit and attribution	In Review
007	Lifecycle and revocation	In Review
008	Data model and APIs	In Review
009	Threat model	In Review
010	MVP scope (the 90-day build)	In Review
011	Open-core boundary	In Review