Pigeon v0.1.0

Your agent spawned a sub-agent and handed it the same API key. That child can now do everything the parent can do.

Pigeon v0.1 replaces that hand-off with a Pigeon Pass: a narrowed, signed credential for what an agent may do. Identity says who it is. Authority says what it may do.

Install

Python 3.12 or newer.

git clone https://github.com/pigeonlabsHQ/pigeon.git
cd pigeon
pip install .

Try it

python examples/01_infrastructure.py
python demo/agent.py

A child granted deploy on environment:staging is allowed to deploy there. The same child is denied on environment:production with RESOURCE_NOT_ALLOWED. Asking for extra capabilities fails closed with PRIVILEGE_ESCALATION.

Public API

from pigeon import Principal, Authority, grant, delegate, verify

• grant mints a root Pass
• delegate mints a child that must be narrower or equal
• verify returns a structured result (allowed, reason_code, message, details), never a bare boolean

There is no Pigeon server. Put delegate where you would have copied a secret into a sub-agent. Put verify where the side effect happens, and do not run the tool if it is denied.

In this release

• Own Pass format (not JWT, Biscuit, or UCAN), Ed25519, canonical JSON specified to the byte
• Fail-closed attenuation for capabilities, resources, and a closed constraint set (including rate and count)
• Chain verification, replay detection, revocation interface
• MCP client/server helpers (enforcement point, not the protocol)
• CLI: pigeon keygen, pigeon inspect
• Conformance fixtures for a future implementation in another language

Not in v0.1

No gateway, no dashboard, no telemetry, no key custody, no framework adapters. Pigeon does not stop prompt injection. It bounds blast radius along the dimensions you encoded, and only those.

Protocol: SPEC.md
Limits: SECURITY.md