OPEN SECURITY PROTOCOL FOR AI AGENTS

Autonomy needs
a boundary.

Give agents room to act.
Define exactly how far they can go.

Try the boundary Read the protocol

Service / Sub-agent / Secure Model-Context ProtocolWORKS OVER MCP + A2A

01 / THE APPROVAL BOUNDARY

INTERACTIVE WALKTHROUGH

>_ approval_inspectorLOCAL EXAMPLE / SHA-256

verify approved

The request matches the approved input, manifest, scopes, task, and price.

HASHING

CONSTRAINT	APPROVED	REQUESTED	Result
Computing the approval and request bindings…

Inspect request & full hashes

Computing hashes locally…

EXAMPLE, NOT A LIVE AGENT RUNProduction bindings are derived and checked on the server.

Real hashes, computed in your browser. Each case starts with a fresh example approval. No agent is called and no payment is made. This illustrates run binding, not host signature verification.

02 / THE PROTOCOL

Permission is
a precise thing.

sMCP adds a security and governance layer to agent communication: declared capabilities, explicit consent, and rules around execution. It works over MCP and A2A.

IDENTITY

Know what you’re calling.

A capability manifest declares what an agent can do. Host attestation signs its fingerprint with Ed25519. A pinned public key and a drift check let the platform verify the declaration.

manifest → SHA-256 → Ed25519

A fingerprint match is not the same as a verified signature.

MODEL BOUNDARY

Keep prose out of authority.

Publisher descriptions are untrusted input. The manifest firewall gives the model an allowlisted view of structured capabilities, schema hashes, scopes, and prices. Free-text instructions stay outside that view.

untrusted manifest → allowlisted view

The full manifest hash remains bound to the approval.

AUTHORIZATION

Approve one exact run.

The broker binds a one-time approval to the manifest, task, input, scope set, and charge ceiling. It derives the binding again at dispatch. A changed binding needs fresh approval.

approval binding === dispatch binding

Single use. Time limited. Computed on the server.

EXECUTION

Guard both directions.

Outbound requests are checked for private-network targets, unsafe redirects, and DNS rebinding. Returned content passes a deny-by-default guard before reaching the user.

validate egress → execute → guard return

One-time execution does not implicitly grant durable agent memory.

IMPLEMENTATION NOTE

DiviDen is the reference implementation. Whole-run consent is the active default. Field-level, time-limited, revocable consent is implemented behind an optional enforcement flag. Host-attestation enforcement is also configuration dependent.

03 / ON THE WIRE

Start with
a declaration.

Discover a node. Inspect its capabilities. Agree on the task. Verify the host.

Explore the specification

01 / DISCOVER A NODE

$ curl -H 'SMCP-Version: 0.1' \
  https://dividen.ai/.well-known/dividen-agent.json

Public endpoint. No credentials required.

Node discovery

Supported versions, public cards, and the node’s protocol entry points.

Capability manifest

Public capabilities and task metadata. Credentials and private dispatch details stay out.

Task contract

Input and output schemas, permission scopes, pricing, and settlement terms.

Host attestation

A manifest fingerprint and signature, verified against the registered host key.

Wire version 0.1 is a draft. Before 1.0, minor versions may change shapes. An unsupported version returns the node’s preferred version with a negotiation mismatch for the client to handle.

04 / BUILT INTO OUR WORLD