@vorim/a2a

Identity and trust layer for the Google A2A (Agent-to-Agent) Protocol.

Extends A2A Agent Cards with cryptographic agent identity, trust scoring, and permission verification so agents can verify each other before interacting.

Install

npm install @vorim/a2a

Python:

pip install vorim  # A2A support included via vorim.a2a

Quick Start

import { createVorimA2A } from '@vorim/a2a';

const a2a = createVorimA2A({ apiKey: 'agid_sk_...' });

// Create a new agent with an A2A-compatible card
const card = await a2a.createAgentCard({
  name: 'research-agent',
  url: 'https://my-agent.example.com',
  provider: { organization: 'Acme Corp' },
  skills: [{ id: 'research', name: 'Web Research', tags: ['search'] }],
  scopes: ['agent:read', 'data:read'],
});
// card.vorimIdentity contains agent ID, trust score, public key fingerprint

// Verify an incoming agent before interacting
const result = await a2a.verifyAgent(incomingAgentCard);
if (result.trusted) {
  console.log(`Trusted with score ${result.score}`);
} else {
  console.log(`Rejected: ${result.reason}`);
}

// Middleware for automatic verification
const handler = a2a.middleware({ minTrustScore: 70 })(async (req) => {
  // Only reached if sender has trust score >= 70
  return { status: 'ok' };
});

Python

from vorim.a2a import VorimA2A

a2a = VorimA2A(api_key="agid_sk_...")

# Extend your Agent Card
card = a2a.extend_agent_card(base_card, agent_id="agid_abc123")

# Verify an incoming agent
result = a2a.verify_agent(incoming_card, min_trust_score=60)

# Decorator middleware
@a2a.middleware(min_trust_score=70)
def handle_task(request):
    return {"status": "ok"}

How It Works

1. Agent Card Extension — Adds vorimIdentity to your A2A Agent Card with Ed25519 public key fingerprint, trust score, permission scopes, and verification URLs.

2. Trust Verification — Before interacting with another agent, queries Vorim's public Trust API to verify the agent's live trust score (not the self-reported score on the card).

3. Permission Checking — Verifies the agent has the required permission scopes for the interaction.

4. Audit Logging — Automatically logs A2A interactions as audit events in Vorim's tamper-proof trail.

Agent Card Extension Format

{
  "name": "research-agent",
  "url": "https://my-agent.example.com",
  "skills": [...],
  "vorimIdentity": {
    "agentId": "agid_abc123",
    "publicKeyFingerprint": "a3f2...e91c",
    "trustScore": 82,
    "status": "active",
    "scopes": ["agent:read", "data:read"],
    "verifyUrl": "https://vorim.ai/v1/trust/verify/agid_abc123",
    "badgeUrl": "https://vorim.ai/v1/trust/badge/agid_abc123.svg",
    "verifiedAt": "2026-04-15T12:00:00Z"
  }
}

Links

• Vorim AI
• A2A Protocol
• IETF Draft
• Protocol Spec