Cryptographic identity, mandatory mTLS, and policy-based authorization for the $20.9B AI agent economy. Security that cannot be bypassed.
$ pip install agentweave
from agentweave import SecureAgent, capability
class PurchaseAgent(SecureAgent):
@capability("negotiate")
async def negotiate(self, order: dict) -> dict:
# Identity verified. mTLS enforced.
# Authorization checked. Audit logged.
return {"status": "accepted"}
agent = PurchaseAgent.from_config("config.yaml")
agent.run()The Security Gap
Every one of these transactions needs verified identity, enforced authorization, and auditable trust.
Architecture
Capabilities
SPIFFE-based workload identity gives every agent a non-forgeable credential. Automatic rotation. No shared secrets. The same standard Netflix, Uber, and Square use.
Read the docs →Mutual TLS on every connection. No exceptions, no downgrades. TLS 1.3 enforced. The secure path is the only path — you cannot ship an insecure agent.
Read the docs →OPA-powered fine-grained access control. Default-deny in production. Policies as code in Rego. Every decision audited and traceable.
Read the docs →First-class Linux Foundation A2A support. Agent Cards, capability discovery, JSON-RPC 2.0 messaging. Interoperate with any A2A-compatible system.
Read the docs →SPIRE federation across trust domains. AWS to GCP to Azure. Vendor-neutral identity that works across organizational boundaries.
Read the docs →OpenTelemetry-native metrics, distributed tracing, structured audit logs. Prometheus-compatible. See every interaction in production.
Read the docs →Interoperability
Linux Foundation standard. Agent Cards, capability discovery, JSON-RPC 2.0. First-class support built in.
OpenAI + Stripe agentic commerce protocol. AgentWeave secures ACP connections with mTLS and identity.
Google + Shopify universal commerce protocol. AgentWeave provides the trust layer regardless of wire protocol.
Why AgentWeave
Quick Start
Python 3.11+ required.
pip install agentweaveIdentity, mTLS, and authorization are automatic.
from agentweave import SecureAgent, capability
class MyAgent(SecureAgent):
@capability("greet")
async def greet(self, name: str):
return {"msg": f"Hello, {name}!"}Point to your SPIFFE trust domain and OPA policies.
agent = MyAgent.from_config("config.yaml")
agent.run()The agent economy will not wait for security to catch up.