Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/agentmessaging/agent-identity/claude-mdgit clone --depth 1 https://github.com/agentmessaging/agent-identityWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.02551 | $0.02551 |
| Opus 5 | $0.01275 | $0.01275 |
| Sonnet 5 | $0.00510 | $0.00510 |
| Haiku 4.5 | $0.00255 | $0.00255 |
Grade E, and why
agent-identity CLAUDE.md scanned grade E with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
keys/private.pem # Ed25519 private key (chmod 600) Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
3. **Remote `curl | bash`** — `install.sh` falls back to downloading scripts from `raw.githubusercontent.com/agentmessaging/agent-identity/main/scripts/` when its sibling `scripts/` dir is absent. Unrestricted tool accessmediumExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
# Run any command directly from the repo without installing Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
3. **Remote `curl | bash`** — `install.sh` falls back to downloading scripts from `raw.githubusercontent.com/agentmessaging/agent-identity/main/scripts/` when its sibling `scripts/` dir is absent. How it starts
The opening of the file, as written. The whole thing — 123 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
What this repo is
A pure-Bash reference client for the Agent Identity (AID) protocol — OAuth 2.0 authentication for AI agents using Ed25519 cryptographic identities. It is distributed three ways from this single repo:
- Standalone CLI —
install.shcopies thescripts/aid-*.shfiles to~/.local/bin. - Claude Code plugin — see
.claude-plugin/plugin.jsonand theagent-identityskill atskills/agent-identity/SKILL.md. - Remote
curl | bash—install.shfalls back to downloading scripts fromraw.githubusercontent.com/agentmessaging/agent-identity/main/scripts/when its siblingscripts/dir is absent.
There is no compiled artifact, no package manager, no test suite, no linter. Edits to scripts/*.sh are the deliverable.
Common commands
# Install locally after edits (also the user-facing install command)
./install.sh # → ~/.local/bin
./install.sh /custom/path # → custom location
# Run any command directly from the repo without installing
./scripts/aid-init.sh --auto
./scripts/aid-request.sh --auth https://auth.example.com/tenant
./scripts/aid-token.sh -a https://auth.example.com/tenant -q
# Worked examples (each is a runnable shell script demonstrating a flow)
./examples/basic-usage.sh
./examples/multi-server.sh
./examples/scoped-tokens.sh
There is no make test, npm test, or equivalent. Validation is by running the example scripts against a live auth server, or by manually exercising the flows described in README.md.
Architecture
The seven scripts
All scripts under scripts/ follow the same pattern: set -e, source ./aid-helper.sh, parse flags, then call helper functions. aid-helper.sh is the only shared module — do not duplicate its logic into the command scripts.
| Script | Role |
|---|---|
aid-helper.sh |
Sourced by every other script. Provides OpenSSL detection, agent-directory resolution, config loading, Ed25519 signing, keypair generation, and RFC 9728/8414 discovery helpers (fetch_protected_resource_metadata, fetch_authorization_server_metadata, discover_from_resource). |
aid-init.sh |
Generates the Ed25519 keypair and config.json for a new agent. |
aid-discover.sh |
Walks RFC 9728 → RFC 8414 to find the AID-enabled auth server for a resource URL. Validates urn:aid:agent-identity is advertised and reads the aid_grant block. |
aid-request.sh |
Agent-initiated registration. Submits a pending request, polls with --poll. Accepts --resource as an alternative to --auth. |
aid-register.sh |
Admin-initiated registration. Requires an admin JWT to immediately bind the agent to a role. |
aid-token.sh |
Exchanges the Agent Identity + proof-of-possession for an RS256 JWT. Caches tokens. Accepts --resource as an alternative to --auth. |
aid-status.sh |
Inspects local identity, registrations, and cached tokens. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 123 lines · 2,551 tokens per session scan E ae2c5447ac77
agent-identity CLAUDE.md is an instructions file published in the GitHub repository agentmessaging/agent-identity (4 stars, last pushed 1mo ago), licensed MIT. It adds 2,551 tokens to every session, about $0.0128 per session on Opus 5. A static security scan graded it E with 4 findings (asks for root, downloads and executes remote code, unrestricted tool access). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
agentstamp CLAUDE.md
Claude Code instructions for vinaybhosle/agentstamp, covering agentstamp — claude code context, project overview, architecture, key details and development conventions.
authgear-server AGENTS.md
AGENTS.md instructions for authgear/authgear-server, covering agents.md, repository layout, documentation map, common commands and start local dev.
pi-anthropic-auth AGENTS.md
Instructions for gotgenes/pi-anthropic-auth, covering agents guide: pi-anthropic-auth, project, primary goal, current status and principles.
fallow-skills AGENTS.md
Instructions for fallow-rs/fallow-skills, covering fallow public skills, start here and validation.
my-ai-tools GEMINI.md
Instructions for jellydn/my-ai-tools, covering 🤖 gemini cli agent guidelines - my-ai-tools, 🚀 project overview, 🛠️ key commands, installation & sync and development & testing.
ThumbGate CLAUDE.md
Claude Code instructions for IgorGanapolsky/ThumbGate, covering claude.md — thumbgate (thumbgate), constants, autonomy directive, what this repo is and canonical product scope.