When one AI agent talks to another, identity today comes down to a shared API key. That works between two services in a controlled environment. It breaks when autonomous agents, built by different organizations, need to trust each other and revoke that trust.
In January 2026, agents on Moltbook spread a "religion" by rewriting other agents' SOUL.md files. No agent could detect the change, and no human could prove the agent was still theirs. Sigil is the open protocol I wrote for this: an agent proves who it is and that it has not been tampered with, and states who controls it.
I wrote the spec (0.1.0-draft) and the TypeScript reference implementation on 31 January 2026 and published v0.1.0 to npm the same day, under the MIT license. Key rotation and revocation came in through a pull request from an outside contributor, which I reviewed and merged the same day. The spec is still a draft.
There is no cloud and no server. Sigil is a TypeScript library (ESM, Node 18 or newer) that runs inside the agent's process and inside whoever verifies it. The flow starts with an Ed25519 keypair: the public key becomes the ID sigil:<base58>, the soul hash condenses the identity files (SOUL.md, IDENTITY.md, AGENTS.md in the skill) with SHA-256 and gets signed, and the Agent Document carries the name, capabilities, declared owner and that attestation, signed with an Ed25519Signature2020 proof. On the other side, the verifier uses the same SDK and takes the public key from the ID itself to check the document, the attestation and the receipts, with no network and no registry.
State stays with whoever uses the library. SigilAgent keeps the current key, the original key, the rotations and the revocations in memory. The OpenClaw skill writes everything as JSON to the workspace's .sigil/ folder: keypair.json holds the private key and is never shared, while identity.json, attestation.json and public.json can be passed around. Nothing is asynchronous: no queues, no events, no network calls, and the SDK does not carry documents or receipts anywhere. Discovery through /.well-known/sigil.json, challenge-response and a registry exist only in the spec.
On a key change, the old key signs the rotation statement, and verifyKeyChain checks continuity and the signature of every step from the original key. Revocations are separate signed statements, which the caller validates before isKeyRevoked takes them into account. The build is tsc into dist/, and prepublishOnly runs the Vitest tests and the build before npm publish. The repository has no CI.
The ID is derived from the public key. Generating a key is enough for the agent to exist.
Alternative rejected: Registration with a central authority that issues and validates identities.
Why: One of the spec's principles is cryptography over authority. A closed identity system for agents creates a gatekeeper in a space that needs to stay open.
Each participant computes reputation locally, from the receipts it can verify.
Alternative rejected: A global trust score kept by a platform.
Why: The spec only defines the receipt format. No global authority hands out scores.
Rotation is signed by the old key, and the ID stays tied to the original key.
Alternative rejected: Having the new key sign the rotation and include the old key, as the rotation issue first proposed.
Why: A signature from the old key proves an authorized handoff, not just possession of the new key. Anyone who already trusts the ID keeps the same reference.
Keep the spec separate from the implementation.
Alternative rejected: Treat the TypeScript library as the definition of the protocol.
Why: I want the protocol to be language-agnostic. Someone writing a Rust or Go implementation should be able to do it from the spec alone.
A minimal core. For now, capabilities are only a list declared in the document.
Alternative rejected: Binding permissions to identity cryptographically in the core.
Why: The spec asks for the smallest possible core. Capability negotiation and delegation are planned as extensions.