A curated list of protocols, tools, and services powering the AI agent infrastructure stack — identity, discovery, communication, payments, and governance.
- Identity — Proof of Personhood
- Agent Identity & Trust
- Agent Discovery
- Communication Protocols
- Payments & Commerce
- Governance & Security
- Contributing
How do humans behind agents prove they're real and unique? Without this layer, Sybil attacks make every other layer fragile.
- World ID — Iris-biometric proof-of-personhood with biometric liveness check. 18M+ verified users, but not available all countries.
- Self Protocol — ZK proofs from passports and national IDs. Covers 60+ countries via NFC chip verification (~1B passports globally). First production ERC-8004 implementation.
- BrightID — Social-graph-based proof of uniqueness. Decentralised, no biometrics required.
- Holonym — Privacy-preserving identity verification using ZK proofs from government IDs. Sybil resistance without biometric hardware.
- Humanity Protocol — Palm-scan biometric proof-of-personhood. Mobile-first, no dedicated hardware.
How do agents prove who they are, who's behind them, and whether they can be trusted?
- W3C Decentralized Identifiers (DIDs) — The foundation. Globally unique, self-sovereign identifiers controlled by the subject, not a central authority. Multiple DID methods exist (
did:web,did:key,did:ion,did:wba). - W3C Verifiable Credentials — Cryptographically signed, tamper-evident, machine-verifiable credentials. The digital equivalent of physical certificates. Trust triangle: Issuer → Holder → Verifier.
- ERC-8004 — Ethereum standard for on-chain agent identity, reputation, and validation registries. Three registries: identity (NFT-based), reputation (on-chain ratings), validation (capability attestations).
- Web Bot Auth — Cloudflare's cryptographic HTTP message signatures (IETF RFC 9421) for bot/agent identity. Ed25519 keys,
/.well-known/http-message-signatures-directory. Production-deployed on the Verified Bots Program. Rust and TypeScript libraries available. - World AgentKit — Extends x402 with proof-of-personhood verification for agents. Agents register on AgentBook (World Chain), verified via World App. Distinguishes human-backed agents from bots.
npm install @worldcoin/agentkit. - ANP Identity Layer — Agent Network Protocol uses
did:wba(DID method anchored to web domains). Decentralised agent identity without blockchain.
How do agents find each other and advertise their capabilities?
- A2A Agent Cards — JSON metadata at
/.well-known/agent-card.json. Agents self-describe capabilities, authentication requirements, and supported protocols. Part of the A2A specification. - AID — Agent Identity & Discovery — Radically minimal DNS TXT record-based bootstrap. Agents publish identity and endpoint info via DNS. Protocol-agnostic.
- agents.json — Structured API workflow contracts on OpenAPI. Agents publish capability manifests at
/.well-known/agents.json. Stateless, HTTP-native. - ANP Agent Description Protocol — Active and passive agent discovery using JSON-LD. Part of the ANP full-stack protocol.
- ERC-8004 Registry — On-chain searchable agent identity registry. Agents register as NFTs with queryable capability metadata.
How do agents talk to tools, to each other, and to users? Three complementary protocols now define the standard communication stack.
| Layer | Protocol | Purpose |
|---|---|---|
| Agent ↔ Tools | MCP | Connect agents to external tools, data sources, and APIs |
| Agent ↔ Agent | A2A | Coordinate tasks across distributed agent systems |
| Agent ↔ User | AG-UI | Stream agent state, tool calls, and interactions to frontends |
- MCP — Model Context Protocol — Anthropic. The standard way agents connect to external tools and data. Dynamic tool discovery, bi-directional communication, capability negotiation. 26,000+ MCP servers indexed. Donated to the Linux Foundation's Agentic AI Foundation (Dec 2025). Spec · GitHub
- A2A — Agent2Agent Protocol — Google / Linux Foundation. Enterprise agent-to-agent communication. Three interchangeable protocol bindings (JSON-RPC 2.0, gRPC, HTTP+JSON). Task lifecycle management, streaming, push notifications. 150+ supporting organisations. Spec · GitHub
- AG-UI — Agent–User Interaction Protocol — CopilotKit. Event-based protocol connecting agents to user-facing frontends. 16 standardised event types. Transport-agnostic (SSE, WebSocket, HTTP binary). 1st-party support from Microsoft, Google, AWS, LangGraph, and more. GitHub
- ANP — Agent Network Protocol — Full-stack decentralised agent protocol with DID identity and meta-protocol negotiation. Agents can dynamically create new communication protocols at runtime.
- AITP — Agent Interaction & Transaction Protocol — NEAR AI. Agent commerce and transactions with marketplace primitives. Thread-based conversations with typed message payloads.
- Agent Protocol — AI Engineer Foundation. Minimal REST interface for agent testing and benchmarking. Simple, unopinionated.
How do agents pay for services and conduct transactions?
- x402 — Coinbase. Internet-native payments via HTTP 402. USDC on Base L2. Designed for micropayments — agents pay per API call, per byte, per inference. 500K+ weekly transactions. GitHub
- AP2 — Agent Payments Protocol — Google + 60 organisations (PayPal, Mastercard, Visa). Open extension for A2A and MCP. Uses Verifiable Digital Credentials (VDCs) for cryptographic proof of purchase intent. Three mandate types: Intent (human-not-present authority), Cart (human-present authorisation), Payment (network signalling). Spec · GitHub
- MPP — Machine Payments Protocol — Tempo Labs / Stripe. IETF HTTP Authentication Scheme for machine-to-machine payments. Payment-method agnostic. Uses HTTP 402 status code with
Paymentheader. - Visa Trusted Agent Protocol (TAP) — Agent verification bridge between traditional card networks and crypto-native payments. x402 compatibility.
How do we control, monitor, and secure what agents do?
- Microsoft Agent Governance Toolkit — Open-source (MIT). Seven packages: policy engine, execution rings, trust scoring, compliance mapping, MCP Security Scanner, DID + SPIFFE/SVID identity. Runtime security for agents.
- Google Secure AI Framework (SAIF) for Agents — Hybrid defence-in-depth: deterministic policy engines + reasoning-based defences. Three principles: well-defined human controllers, limited powers, observable actions.
- ServiceNow AI Control Tower — Centralised hub for managing, monitoring, and governing any AI agent (internal or third-party). Part of ServiceNow's AI Agent Fabric with native A2A + MCP support.
- OWASP Top 10 for Agentic Applications — Standardised risk taxonomy for agentic AI. Ten threat categories including goal hijacking, tool misuse, identity abuse, and supply chain compromise.
- Langfuse — Open-source LLM observability. Acquired by ClickHouse (Jan 2026). 26M+ SDK monthly installs, 19 Fortune 50 clients. Tracing, evaluation, and monitoring for agent workflows.
- Portkey — AI gateway with 10B+ monthly requests. 99.9999% uptime, sub-10ms latency. 40+ pre-built guardrails for agent safety.
- AgentOps — Session replays and failure detection for AI agents. Two lines of code to start.
- Arize Phoenix — Open-source agent observability on OpenTelemetry. Framework-agnostic tracing and evaluation.
Contributions welcome! Please read the contribution guidelines before submitting a PR.
If you know of a protocol, tool, or service that belongs on this list, please open an issue or submit a pull request.
To the extent possible under law, the authors have waived all copyright and related or neighbouring rights to this work.