OATHERA KYA (Know Your Agent) DEMO

Checking backend services… The demo runs only when all three backend services are up.

AIS … Agent Identity Service— IDP … OpenID Provider— VCI … Verifiable Credential Issuer—

Demo-driven components

These four run as simulated demo instances (browser-driven, not the real deployed services). Only AIS, IDP and VCI above are live OATHERA services.

Agent Identity MCP Gateway MCP Resource Server

Enrolment

UC-1 · agent is given a sender-constrained identity

Step 1

Connect the MCPs

Spawns the Identity MCP and the Resource Gateway MCP over stdio, exactly as the demo agent does.

Step 2

Declare attributes

The Identity MCP elicits these; they are recorded as self_reported evidence.

Label Agent type Version Model OS Capabilities

Step 3

Human authorizes

Nothing exists until a person opens this URL. Open it yourself, or authorize a demo user here.

no pending enrolment

Step 4

Issue a scoped token

Rotates a session key, sends an anchor-signed naming JWT, and takes back a scoped token. In vc format the AIS calls the VCI first and returns W3C credentials alongside it.

Credential format

Enforcement

UC-2 · the identity is spent on one call

Step 5

Sign and call

sign_operation at the Identity MCP, then the same operation at the Gateway MCP.

Operation Title Body

Reset

Start over

Closes both MCP connections and clears the trace. Add --fresh style cleanup by deleting .identity-mcp-state.json.

Live trace

0 events

Connect the MCPs to start.

Inspector

Click any event in the trace.

Adversarial replays

run against the live gateway and resource server