Your fleet grows past a dozen agents and nobody can say how many exist, who created them, what they can do, or when they should expire. That is agent sprawl, and it becomes shadow IT at scale. Krikos gives each agent a cryptographic identity, the capabilities it may exercise, an enforced lifecycle, and an append-only, hash-chained audit trail. The IAM for non-human entities.
You issue an identity for each agent in your fleet. Each one gets a stable fingerprint, the capabilities it is allowed to use, and an expiration. Krikos answers one question at the boundary: may this agent do this, right now? A revoked, suspended, or expired agent always gets no. Every issue, activation, rotation, and revocation is written to an audit trail you can replay, exactly like an employee directory for non-human workers.
A deterministic registry over an enforced lifecycle state machine (provisioned, active, suspended, revoked, expired, archived), fail-closed capability authorization with resource scoping, optional Ed25519 cryptographic identity with A2A Signed Agent Cards, and a hash-chained, append-only audit trail. Pluggable state persistence, guards for the Vercel AI SDK and MCP, a stateless edge verifier, and framework bridges. Zero runtime dependencies.
Take a real enterprise scene: the CISO asks for a complete list of every agent in production, who owns it, what it can touch, and when it expires. Teams have been shipping agents for months, each its own way.
krikos.list() returns every agent with owner, capabilities, and expiry.krikos.stats() gives counts per lifecycle state in one call.revoked; its capabilities are gone, fail-closed.verifyAuditChain() confirms the record was not tampered with.The "Without Krikos" timeline is the documented experience reported by enterprise platform teams facing agent sprawl; the Salesforce 2026 Connectivity Benchmark put the average fleet at a dozen agents, growing 67 percent in two years.
install to first rotation.pnpm add @takk/krikosnpm install @takk/krikosyarn add @takk/krikosbun add @takk/krikosThe core has zero runtime dependencies. Siblings are optional peers, matched structurally and never imported at runtime. Skip this unless you wire a bridge.
pnpm add @takk/keymesh # revoke an
agent's credentials on revocation
pnpm add @takk/gaptime # record agent
lifecycle as bi-temporal factsimport { createKrikos } from '@takk/krikos';
const krikos = createKrikos();
// Issue an identity for an agent and activate it.
const agent = krikos.issue({
name: 'billing-reconciler',
issuer: { id: 'platform-team' },
capabilities: [{ name: 'payments', actions: ['read', 'refund'], resources: ['/invoices/*'] }],
activate: true,
});
// Fail-closed authorization at the boundary, recorded in the audit
trail.
if (krikos.authorize(agent.id, 'payments', 'refund', '/invoices/2026-06')) {
// ... perform the refund
}
// A revoked agent can never authorize again.
krikos.revoke(agent.id, 'offboarded');
console.log(krikos.verifyAuditChain()); // trueimport { createKrikos } from '@takk/krikos';
import { issueSigned, nodeSigner, toAgentCard, verifyAgentCard } from '@takk/krikos/a2a';
const krikos = createKrikos();
const signer = nodeSigner();
// Issue, generate an Ed25519 key pair, sign, and attach the signature.
const { agent, keyPair } = await issueSigned(
krikos,
{ name: 'web-researcher', issuer: { id: 'platform-team' }, activate: true },
signer,
);
// Verify a Signed Agent Card against the pinned issuer key, no registry needed.
const card = toAgentCard(agent);
console.log(await verifyAgentCard(card, signer, keyPair.publicKey)); // trueEvery agent is issued an opaque id, a deterministic fingerprint, declared capabilities, an issuer, and metadata. Records are immutable and frozen; the registry is fully deterministic.
A complete, queryable inventory of your fleet: who exists, who created them, and what they can touch, available in one call.
Each agent declares the capabilities it may exercise, scoped by action and resource pattern.
can() and authorize() answer fail-closed.
An over-reaching agent never silently performs an action it was not granted. Default-deny, not default-allow.
Six states (provisioned, active, suspended, revoked, expired, archived) with a single legal-transition table. Illegal moves are rejected whole.
An agent can only ever be in a state you intended, and only an active one can act.
Rotate a credential to a new fingerprint, expire an identity at an instant, sweep past-expiry agents, and renew to bring one back. Expiry is enforced fail-closed on the read.
No long-lived, never-reviewed agent credentials lingering in production indefinitely.
Optional Ed25519 signing of an agent's passport, with interchangeable Node and Web Crypto signers and A2A-aligned Signed Agent Cards that verify against a pinned issuer key anywhere.
A receiving party that has pinned the issuer's key can confirm an agent is who it claims to be before any interaction, across organizational boundaries.
Every lifecycle and access event is emitted to in-process listeners (agent.issued,
agent.revoked, access.denied, and more), zero OpenTelemetry dependency.
Drop events into the logger or metrics pipeline you already run; no new agent, no new vendor.
Every operation appends one frozen, hash-chained event. verifyAuditChain() detects
tampering. The trail is append-only and is never pruned.
Reconstruct who could do what, and when, with a record that flags any retroactive edit.
Memory backend by default; opt-in file backend with atomic writes and corrupt-snapshot quarantine, or any key-value store. Mirror to Postgres, SQLite, or KV for cross-process query.
Durability and cross-service inventory without coupling Krikos to any database driver.
Every published version signed with npm publish --provenance through GitHub Actions OIDC.
Lockfile committed; supply-chain policy enforces minimum release age on new dependency versions.
Verify in one command that the tarball you installed was built from the source commit you trust.
An agent moves only along the moves the table permits. Any other transition throws
ERR_INVALID_TRANSITION and leaves the registry untouched.
| State | Meaning | Can authorize |
|---|---|---|
provisioned |
Issued, not yet activated. The default state on issue(). |
No |
active |
Live. The only state that authorizes, and only while not past expiry. | Yes |
suspended |
Temporarily disabled by an operator; reversible with resume(). |
No |
revoked |
Permanently invalidated. Terminal except for archival. | No |
expired |
Past its expiration instant. Can be renewed back to active. | No |
archived |
Retired record kept for audit. Terminal. | No |
rotate() is not a state change; it bumps the credential version and recomputes the fingerprint
while preserving the lifecycle state.
| Surface | Subpath export | Runtime deps | Use it when |
|---|---|---|---|
| Core | @takk/krikos |
none | Issue, list, lifecycle, capability authorization, audit. |
| A2A | @takk/krikos/a2a |
none | Ed25519 signing, Signed Agent Card export and verification. |
| Vercel AI SDK | @takk/krikos/vercel |
none | Authorize an agent's tool calls before they run. |
| MCP | @takk/krikos/mcp |
none | Validate agent identity before honoring an MCP request. |
| Store | @takk/krikos/store |
none | Write-through registry mirror to Postgres, SQLite, or KV. |
| Edge | @takk/krikos/edge |
none | Stateless identity verification at the boundary, before execution. |
The same engine the library exposes, over a JSON state file. Issue agents, authorize them fail-closed, drive the lifecycle, and verify the audit chain, no code required.
npx @takk/krikos issue --state fleet.json \
--name billing-bot \
--issuer platform-team \
--cap payments:read,refund@/invoices/* \
--activate# exit 0 allow, exit 3 deny
npx @takk/krikos can --state fleet.json \
--id <id> --capability payments --action refund --resource /invoices/2026
npx @takk/krikos revoke --state fleet.json --id <id> --reason offboarded
npx @takk/krikos verify --state fleet.json # exit 0 intact, 4 broken
npx @takk/krikos serve --state fleet.json --port 4385 --token $KRIKOS_TOKENRegister a listener on the registry. Every event is a typed object; the union
TelemetryEvent is exported so you can branch on event.kind with full narrowing in
TypeScript. A listener exception is swallowed and never reaches a caller.
const off = krikos.on((event) => {
switch (event.kind) {
case 'agent.issued': log.info({ agentId: event.agentId }); break;
case 'agent.revoked': alerts.notify(`agent ${event.agentId} revoked`); break;
case 'access.denied': metrics.increment('krikos.denied'); break;
}
});
off(); // unsubscribeconst stats = krikos.stats();
// {
// total: 12,
// byStatus: { provisioned: 2, active: 7, suspended: 1, revoked: 1, expired: 1, archived: 0 },
// authorizable: 7,
// issuers: 3,
// auditEvents: 58
// }
const recent = krikos.auditTrail({ limit: 10 });
const intact = krikos.verifyAuditChain(); // true
The audit trail is append-only and is never pruned; prune(beforeArchivedAt) only drops archived
agent records to bound the live registry, leaving the operation history intact.
The other tools in this space solve adjacent problems well. The contrast clarifies where Krikos sits.
| Capability | Krikos | Auth0 / WorkOS | LangSmith / Langfuse | Agentforce | Hand-rolled |
|---|---|---|---|---|---|
| Identity subject | non-human agents | humans | n/a (traces) | platform agents | your model |
| Cross-platform | any framework | yes | yes | Salesforce only | varies |
| Capability authorization | fail-closed | RBAC for humans | no | yes | rarely |
| Enforced lifecycle | state machine | user states | no | partial | no |
| Hash-chained audit | hash-chained | logs | traces | logs | rarely |
| Distribution | npm library | SaaS | SaaS | SaaS | your repo |
| SaaS lock-in | none | yes | yes | yes | none |
| License | Apache-2.0 | commercial | mixed | commercial | your call |
The honest summary: Auth0 and WorkOS own human identity. LangSmith and Langfuse own observability. Agentforce owns identity inside Salesforce. Pick Krikos when you need a cross-platform, embeddable identity and authorization layer for non-human agents, with no SaaS to operate.
126 tests passing across 16 suites under Vitest 4, on Node 22 and Node 24. Coverage:
about 92% lines, 92% statements, 84% branches. Run pnpm test on a fresh clone to reproduce.
TypeScript 6 in maximum strict mode (exactOptionalPropertyTypes,
useUnknownInCatchVariables, noUncheckedIndexedAccess,
noImplicitOverride, noImplicitReturns). Zero errors under tsc
--noEmit.
Biome 2 clean across src, tests, and examples.
publint clean. Exports map is dual ESM + CJS with separate .d.ts and
.d.cts per subpath.
An S1 to S10 fleet-governance benchmark walks one enterprise fleet through issue, authorize, suspend, resume, rotate, expire, revoke, archive, and prune, asserting the audit chain stays intact at every step.
The CLI suite spawns the built binary (never the tsx wrapper) and asserts the krikos 1.0.0
version contract, the issue and authorize flow, and the exit codes for allow, deny, and a broken audit
chain.
Committed pnpm lockfile, supply-chain policy with minimum release age, SLSA provenance attestation on
every published version. Verify with npm view @takk/krikos@1.0.0 --json | jq
.dist.attestations.
Yes. 126 tests across 16 suites pass under Vitest 4 on Node 22 and Node 24, with about 92% line coverage;
TypeScript 6 maximum strict mode is clean; Biome 2 lint is clean; publint is clean;
attw is green across all eight entry points. Every published release carries SLSA provenance
produced by GitHub Actions, and an S1 to S10 fleet-governance benchmark exercises the full lifecycle.
Those manage human identity. Krikos manages non-human identity: agents, with the capabilities they declare, an expiration, a credential to rotate, and an audit trail, governed the way a workforce identity platform governs employees.
Those are observability: they tell you what an agent did. Krikos is identity and authorization: it decides what an agent may do before it does it, and revokes that ability the moment the agent is retired.
Yes. The core, a2a, web, and edge surfaces use only standard APIs,
including Web Crypto for signing off Node. The Node-only fileState backend is excluded from
the web and edge entry points, so those bundles never advertise a backend they
cannot run.
No. Krikos runs entirely inside your own process. It makes no outbound network calls, collects no telemetry, ships no analytics, and never calls a provider API. It has zero required runtime dependencies.
can() returns true only for an active, unexpired agent that declares a matching capability,
action, and resource scope. A provisioned, suspended, revoked, or expired agent can never authorize, and
expiry is enforced on the read even before an explicit sweep. The default is deny.
In-process memory by default. For durability use the file backend, or kvState
over Redis, Upstash, or Cloudflare KV. For cross-process query, mirror the registry into Postgres,
SQLite, or a key-value store with @takk/krikos/store.
Real. @takk/krikos/a2a signs an agent's canonical passport with Ed25519, using
node:crypto on Node and Web Crypto in the browser and at the edge, with byte-identical key
encoding so a Signed Agent Card verifies anywhere. The deterministic fingerprint is separate, and is used
for identity bookkeeping.
The hash chain is tamper-evident integrity bookkeeping: it catches accidental corruption and naive edits,
and verifyAuditChain() flags them. For cryptographic non-repudiation, sign agents with the
Ed25519 signer or sign the snapshot out of band. This is documented in SECURITY.md.
Every release is published with npm publish --provenance. Check the attestations with
npm view @takk/krikos@<version> --json | jq .dist.attestations. The attestation links
the tarball you installed to the GitHub Actions workflow that built it from a specific source commit.
Strict SemVer 2.0.0, starting from 1.0.0. The binding stability surface is documented in SPEC.md section 5. Major bumps require a deprecation cycle; security fixes follow the disclosure flow in SECURITY.md.