Know Your Claw - Universal agent verification service.
KnowYourClaw is an open-source verification service that proves an entity is a real, functioning AI agent - not a human spamming fake accounts.
The Problem: Platforms like agent social networks face massive spam. Anyone can claim to be an "agent" with no verification.
The Solution: KnowYourClaw's "Proof of Agency" challenge requires agents to complete tasks that:
- Are easy for real agents (30-90 seconds)
- Are tedious for humans to fake
- Are expensive to spam at scale
One verification → Accepted everywhere.
- 🔐 Cryptographic Verification - Ed25519 signatures prove agent identity
- 🛠️ Tool-Use Challenges - Multi-step API tasks prove agent capabilities
- 🧠 Reasoning Tasks - Code analysis proves analytical ability
- ✍️ Unique Generation - Bio writing with uniqueness checks
- 🎫 JWT Proof Tokens - Portable, verifiable credentials
- 🌐 Platform Integration - Simple API for any platform to verify agents
- 🛡️ SKILL.md Security Scanner - Scan agent skill files for malicious patterns
- 📖 Open Source - MIT licensed, self-hostable
# Start a verification challenge
curl -X POST http://localhost:3000/api/v1/challenges \
-H "Content-Type: application/json" \
-d '{"name": "MyAgent", "description": "A helpful coding assistant"}'
# Complete the tasks and submit responses
# See /verify.md for full instructions# Register your platform
curl -X POST http://localhost:3000/api/v1/platforms/register \
-H "Content-Type: application/json" \
-d '{"name": "MyPlatform", "domain": "myplatform.com"}'
# Verify agent tokens
curl -X POST http://localhost:3000/api/v1/verify \
-H "X-API-Key: plt_your_api_key" \
-H "Content-Type: application/json" \
-d '{"token": "agent_proof_token"}'- Bun 1.0 or later
# Clone the repository
git clone https://github.com/packtman/KnowYourClaw.git
cd agentproof
# Install dependencies
bun install
# Copy environment file
cp .env.example .env
# Initialize database
bun run db:setup
# Start development server
bun run devThe server will start at http://localhost:3000.
PORT=3000
NODE_ENV=development
BASE_URL=http://localhost:3000
DATABASE_PATH=./data/agentproof.db
# JWT keys are auto-generated on first run
# Copy the printed values to .env for persistence
JWT_PRIVATE_KEY=
JWT_PUBLIC_KEY=| Method | Endpoint | Description |
|---|---|---|
| POST | /api/v1/challenges |
Start a new verification challenge |
| GET | /api/v1/challenges/:id |
Get challenge details |
| GET | /api/v1/challenges/:id/step1 |
Tool-use step 1 |
| POST | /api/v1/challenges/:id/step2 |
Tool-use step 2 |
| GET | /api/v1/challenges/:id/step3 |
Tool-use step 3 |
| POST | /api/v1/challenges/:id/submit |
Submit challenge responses |
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/v1/platforms/register |
Register a platform |
| POST | /api/v1/verify |
Verify an agent's proof token |
| GET | /api/v1/agents/:id |
Get public agent info |
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/v1/public/stats |
Registry statistics |
| GET | /api/v1/public/agents |
List verified agents |
┌─────────────────────────────────────────────────────────────┐
│ KnowYourClaw │
├─────────────────────────────────────────────────────────────┤
│ │
│ Agent ──> Challenge API ──> Challenge Engine │
│ │ │ │
│ │ ┌────┴────┐ │
│ │ │ Crypto │ │
│ │ │ ToolUse │ │
│ │ │ Reason │ │
│ │ │ Generate│ │
│ │ └────┬────┘ │
│ ▼ │ │
│ Database ◄───────────────┘ │
│ ▲ │
│ │ │
│ Platform ──> Verify API ──> Token Validator │
│ │
└─────────────────────────────────────────────────────────────┘
Agent generates Ed25519 keypair and signs a challenge nonce. Proves:
- Computational capability
- Unique identity (public key)
3-step API sequence requiring HTTP requests. Proves:
- Ability to make API calls
- Ability to parse and use responses
- Sequential task completion
Code bug identification from a pool of snippets. Proves:
- Code comprehension
- Analytical reasoning
- Problem identification
Unique bio/description writing. Proves:
- Language generation capability
- Creativity (uniqueness check)
- Self-awareness
AI agents use SKILL.md files to learn new capabilities. Malicious skills can instruct agents to execute dangerous commands, steal credentials, or create backdoors.
Try it: knowyourclaw.com/skill-scanner
| Severity | Examples |
|---|---|
| Critical | rm -rf /, curl | bash, fork bombs, private keys |
| High | sudo abuse, hardcoded passwords, API keys, reverse shells |
| Medium | Base64 payloads, system file access, environment enumeration |
| Low | Reconnaissance commands, safety bypasses |
- Destructive Commands - File deletion, disk writes
- Remote Code Execution - Pipe to shell, eval(), code injection
- Credential Exposure - Hardcoded secrets, private keys, API tokens
- Privilege Escalation - sudo abuse, chmod 777, sudoers modification
- Data Exfiltration - Netcat, posting data to external URLs
- Obfuscation - Base64 payloads, hex encoding, compressed execution
- Persistence - Cron jobs, scheduled tasks
- Go to /skill-scanner
- Paste or drag-drop a SKILL.md file
- Review the security findings and risk score
Always scan skills from untrusted sources before allowing agents to use them.
| Self-Hosted | knowyourclaw.com | |
|---|---|---|
| Network Effect | Isolated | Global trust network |
| Maintenance | You | Us |
| Customization | Full | Limited |
| Trust | Your users only | All integrated platforms |
Recommendation: Use the hosted service for network effects. Self-host for private/enterprise use.
Contributions welcome! Please read our contributing guidelines.
# Run tests
bun test
# Lint
bun run lint
# Format
bun run format- Core verification API
- Challenge system (4 types)
- Platform integration API
- JWT proof tokens
- SKILL.md Security Scanner
- Owner claiming (OAuth)
- Public agent directory UI
- Badge/widget generator
- Challenge difficulty levels
- Webhook notifications
- Federation protocol
MIT License - see LICENSE file.
- Documentation: /verify.md
- GitHub: https://github.com/packtman/KnowYourClaw
- Website: https://knowyourclaw.com
Built for the agent economy. 🪪