MCP and A2A compliance is the wire format. The trust model lives one layer down — in the gateway everything passes through. Three rules hold it together: identity is derived, never asserted; consent is a mandate, not a session; and credentials never travel with the agent.
Identity bootstrap isn't a human-only web flow. An agent registers itself, cryptographically, over MCP — and ends up with the same first-class account a human gets.
Two public tools — auth_wallet_challenge and auth_wallet_verify — turn a keypair into an account. From there it's first-class: claim a public page, author and publish, hold saved keys, buy capacity.
People sign in with Google or by signing the same wallet challenge. We deliberately don't custody passwords.
Every request — human UI, MCP agent, A2A — terminates at one gateway. It stamps the true owner from the verified token and overwrites anything the caller asserts about itself before the call touches anything downstream.
We hold this rule the hard way: early doors that trusted a body-supplied wallet or tier were found, closed, and turned into permanent regression tests — a new execution door isn't "done" until a test proves a caller asserting someone else's identity lands on its own. Per-user resolution is also required to be a pure function of per-request inputs: no shared mutable state that one user's traffic writes and another's reads.
Link a real app one time — X, GitHub, Google, or any MCP server. The token lives in Rokha's broker. From then on, any workflow you choose to run can act on your account — and the code doing the work never sees the credential.
After a single OAuth connect, any rig you run — including ones built by strangers — can act on your account through the broker.
Your personal MCP gateway bundles any external MCP servers behind one Rokha endpoint. Your client authenticates with your Rokha token only — upstream credentials are injected server-side.
github_search); collisions are impossibleFor agents acting with real authority — signing, paying, minting, calling contracts — Rokha's Signet layer turns consent into a first-class object: a scoped, expiring, revocable grant.
Signet is a tool surface, not just a UI: signet_connect · signet_grant · signet_submit · signet_action · signet_status — JWT-gated, owner derived from the verified token.
When you run someone else's published workflow, it executes under your identity, quota, keys, and grants — never the creator's.
Every run bills the runner: a visitor on the free tier under their own session scope, a logged-in user on their own plan. A creator's published rig costs the creator nothing when strangers run it.
Secret resolution only happens against the verified caller identity — the anonymous door strips it entirely. A visitor literally cannot spend a creator's keys; if a rig needs a credential, the runner supplies their own connect or saved key.
This boundary is held by regression tests: a caller asserting the creator's wallet and a paid tier must land on its own anonymous scope and the free tier. The test failing blocks the ship.
Register an identity over MCP, connect your apps once, and grant exactly the authority you mean to — revocable, audited, yours.