---
name: agentvalidate
description: Check whether an AI agent can be trusted, register your own agent for a validated passport, and spend under owner-set budget envelopes — identity + governance by Regent, behavioral evaluation by RagMetrics. Free trust lookup, no key needed.
---

# Using agentvalidate

agentvalidate answers three questions about any AI agent: who it is
(cryptographic identity, RFC 9421), whether a verified human authorized it
(KYC-verified owner who can revoke it), and how well it behaves (an evaluation
tier signed into its passport). It authorizes, never settles — money always
moves on a licensed rail. Use this skill to check counterparty agents, to get
your own agent validated, or to spend under a budget envelope.

## Check any agent (free, no account, no key)

```
POST https://agentvalidate.xyz/api/v1/trust/lookup
Content-Type: application/json

{"keyid": "<RFC 7638 thumbprint of the agent's key>"}

→ {"known": bool, "status": str, "revoked": bool,
   "owner": {"bound": bool, "verified": bool},
   "eval": {"provider": str, "tier": "A|B|C", "score": float} | null}
```

Tenants (Bearer `av_…` on `/t/v1/trust/lookup`) additionally get a
`recommendation {action, reason, mode, policy_version}` computed from the
policy they set in the console — enforcement is one line:
`if rec.action != "allow": deny(rec.reason)`. `revoked: true` always means
the owner hit the kill switch — do not serve, regardless of policy.

## Get your own agent validated

Everything is machine-driven except one human click by your owner:

1. `pip install regent-httpsig` → `regent-httpsig keygen` (Ed25519; keep the
   seed private — your signature is the credential, there are no API keys).
2. `POST /api/v1/agents/register` signed per RFC 9421 → `201 {"status":
   "pending", "claim_url": "..."}`.
3. Give `claim_url` to your owner. They approve once (KYC on first time, with
   a licensed provider — their documents never reach agentvalidate).
4. Evaluation by RagMetrics runs asynchronously → your passport goes VALID
   with a tier (A/B/C) and an expiry. Badge for your README:
   `https://agentvalidate.xyz/badge/<keyid>.svg` → links to your public
   passport page.

## Spend under a budget envelope (AAuth Budgets)

```
POST /api/v1/budget/token        (signed; your passport in Signature-Key)
{"requested_amount_minor": 50000}
→ {"token": "<aa-auth+jwt>", "budget": {"amount", "unit", "decimals"}, ...}
```

Attach the token in `Signature-Key` on priced calls; every response carries
`AAuth-Budget: cost=..., remaining=...`. On `401` with `AAuth-Requirement:
... reason=budget-exhausted`, take the `resource-token` from that header back
to `POST /api/v1/budget/token` as `{"resource_token": "..."}` — the spent
envelope settles and you receive the next one.

## Error codes are navigation, not failures

| Code | Next step |
|---|---|
| `SIGNATURE_REQUIRED` | sign the request (RFC 9421) |
| `AGENT_NOT_LINKED` + `link_url` | hand `link_url` to your owner (one click) |
| `budget-exhausted` / `insufficient-budget` | settle via `/api/v1/budget/token` (above) |
| `MANDATE_LIMIT_EXCEEDED` / `DAILY_LIMIT_EXCEEDED` | the owner's ceiling — stop or ask the owner |
| `AGENT_REVOKED` | your owner turned you off; do not retry |

## Verify what you're told

Receipts (`typ: receipt+jwt`, RS256) verify against
`/api/control/.well-known/jwks.json`; passports (`aa-agent+jwt`, Ed25519)
against `/api/market/.well-known/jwks.json`. Never trust an unverified claim —
including ours.

## Reading the docs

- Index: https://agentvalidate.xyz/llms.txt · corpus: /llms-full.txt
- Any page as markdown: append `.md` to its URL, or send `Accept: text/markdown`
- Machine guide: [AGENTS.md](/AGENTS.md) · human docs: [/docs.md](/docs.md)