Inam MCP server

Inam Protocol Registry

The open reputation, verification, and economic-history layer for the agent economy. INAM is not an agent communication protocol (that's MCP/A2A), not an identity or authorization replacement (that's AgentPass/AITP/Passport Alliance/DID), and not an agent runtime — it's the neutral record of "this work actually happened between these two agents, and here's their evidence-based track record." Full specification: SPEC.md, also readable at docs.inamprotocol.org alongside an interactive API reference generated from openapi.yaml (source in docs-site/).

This directory is the Node/TypeScript reference implementation: Express registry server, did:key identity, sybil-resistant reputation engine, and the InamClient SDK. The SDK itself is published standalone as inamprotocol (source in sdk-js/ — the exact code this server and the Worker deployment import, not a separate build). A parity Python SDK is published as inamprotocol on PyPI (source in sdk-python/). Node 22 — zero native dependencies (pure-JS crypto and a file-backed store), so npm install never needs a C++ toolchain.

Run it

New here? Start with QUICKSTART.md — zero to a real, changed reputation score in about two minutes, against the live registry.

sdk-js is a separate nested package that this server imports directly by relative path (see "What's here" below), so it needs its own npm install too — see CONTRIBUTING.md if npm run dev fails with a missing-module error.

npm install
cd sdk-js && npm install && cd ..
npm run dev      # starts the API on http://localhost:4021
npm run demo     # in another terminal: registers two agents, links an external
                  # identity, runs two jobs end to end, prints the resulting
                  # reputation
npm test         # canonical-JSON, did:key/signing, and receipt-lifecycle tests

Data is persisted to data/*.json (gitignored). Delete that folder to reset the registry to empty. Tests never touch it — they run against a fresh temp directory (see tests/setupEnv.ts).

Cross-language interop demo

bash scripts/run-interop-demo.sh

Registers a TypeScript-side "requester" and a Python-side "worker" (see sdk-python/) against the same live server, has the Python worker submit two signed Execution Receipt drafts, has the TypeScript requester countersign them, and prints the worker's resulting reputation. This is the real end-to-end proof that the protocol — not just one SDK — works: the server verifies Python-produced Ed25519 signatures, and both SDKs agree byte-for-byte on canonical JSON. See sdk-python/tests/test_interop.py for the same guarantee as a fast, no-server-required unit test.

Live deployment

worker/ is a second, independent implementation of the same API surface — Hono + Cloudflare D1 (SQL) + KV (idempotency cache), deployed to Cloudflare Workers — kept behaviorally identical to the Node reference server (same routes, same signature scheme, same reputation math; verified by running the demo and smoke-test scripts against both and diffing the output). It reuses sdk-js/src/crypto/ and sdk-js/src/core/receiptContent.ts unchanged rather than re-implementing them, so the cryptographic core has exactly one source of truth across all three runtimes (Node, Workers, Python).

Currently live at https://api.inamprotocol.org (custom domain, bound via worker/wrangler.jsonc; the *.workers.dev URL still works too as a fallback).

Shortened. The full README is on GitHub.