Agent Passport Documentation
Source-backed documentation for the v1.0 OSS release. Start with a task path, then use the reference documents for implementation and operations detail.
Just want to run it? Skip to the root Start with the project overview, then follow the quickstart.
Start here
| Goal | Read |
|---|---|
| Run locally | Root quick start |
| Five-minute setup | Quickstart |
| Call the API | API reference, OpenAPI contract |
| Install an SDK | SDK guide, TypeScript package, Python package |
| Understand decisions | Concepts, Known limitations |
| Deploy and operate | Operations, Architecture |
| Self-host it | Self-hosting |
| Review security | Security, Known limitations |
| Contribute or release | Contributing, Support policy, Release checklist |
Documentation map
| Guide | What's in it | Read when… |
|---|---|---|
| Architecture guide | System design, middleware stack, request lifecycle, smart contracts, caching, data flow, scaling | Onboarding a new contributor; reviewing the system before deploying |
| API reference | HTTP endpoint reference, error codes, health/readiness, x402 pricing | Integrating via curl, Postman, or an SDK |
| OpenAPI contract | OpenAPI 3.0 spec — every route, request body, and response schema | Generating a typed client (openapi-generator, openapi-typescript) |
| Algorithm and scoring reference | Trust scoring, delegation graph, Sybil detection, reputation, credit/underwriting, passport document | Reviewing the algorithms; debugging a wrong score; understanding the math |
| Security guide | Threat model, defence-in-depth layers, attack surface, mitigations | Reviewing for a production deployment; threat-modelling a new feature |
| Operations guide | Environment variables, deployment, observability (metrics/SLOs/alerts), rate limiting, idempotency, system exposure cap, graceful shutdown, load testing | Operating the service in any environment |
| Known limitations | Public decision, runtime, and hosted-service boundaries | Evaluating the system for production use |
| Support policy | Community support and compatibility expectations | Adopting the project or opening an issue |
| Release checklist | The v1.0 release gate | Cutting a release |
| Quickstart | Five-minute local setup and first request | Running the project for the first time |
| SDK guide | TypeScript and Python installation and integration guidance | Adding Agent Passport to an application |
| Self-hosting guide | Production environment, Docker, probes, and replica boundaries | Deploying the service |
Root-level files
These are at the repo root for GitHub-UI reasons (badges, security advisories, contribution flow). The docs directory stays focused on the canonical reference.
- Project overview — project landing page, install, quick start
- Release notes — version history
- Contributing — how to contribute
- Security disclosure — vulnerability disclosure policy
- License — MIT
- Community standards — community standards
Source-of-truth principle
Every number, threshold, and default in these docs is verified against the code on every PR. The CI gate fails if:
- A new environment variable in
.env.exampleis missing from the operations guide - A new endpoint in
src/app.tsis missing from the API reference - A new metric in
src/lib/metrics.tsis missing from the observability guide - A new test file in
src/__tests__/is missing from the algorithm reference
This keeps the docs honest. A wrong doc is worse than no doc.