Developer tools
Public npm packages, a working starter, and the oaid CLI for identity, verification and avatars.
The current public developer path uses @openagentid/sdk@0.7.2, create-openagent@0.5.2 and, when needed, @openagentid/oidc@0.2.0. The SDK and starter need Node 20+; OIDC needs Node 20.19+.
Run the starter, or install the SDK into an existing application:
npm install @openagentid/sdk@0.7.2
npx oaid --helpAfter installation, npx oaid uses the package's installed executable. For a one-off pinned CLI without installing it in the application:
npm exec --package=@openagentid/sdk@0.7.2 -- oaid --helpDirect entry points
| Import | Responsibility |
|---|---|
@openagentid/sdk/local | Node-only persistent signer and receiver workspace |
@openagentid/sdk/identity-verification | Current authoritative identity, proof and lineage checks |
@openagentid/sdk/verification-api | Fetch verification handler and configured HTTPS client |
@openagentid/sdk/oats | Verified evidence ingestion and scoring |
@openagentid/sdk/characters | Deterministic character SVG, appearance and catalogs |
@openagentid/sdk/character-state | Strict status/expression/pose parsing |
@openagentid/sdk/character-animation | Clock-driven frames without a DOM |
@openagentid/sdk/browser | Self-contained ESM browser player |
@openagentid/sdk/glyph | Canonical OAS Glyph and profile avatar fallback |
Local identities and avatars work without optional OAS/Arsenal/AEGIS facade clients. The older OpenAgentRuntime facade requires real configured clients; endpoint strings alone do not construct them.
Identity and public trust exchange
Create a private signer and separate receiver with the same intended application audience. Choose fresh directory names; initialization refuses to overwrite state.
npx oaid init --directory agent-keys --audience urn:example:my-receiver
npx oaid agent create --directory agent-keys --name researcher
npx oaid init --directory app-trust --audience urn:example:my-receiverRead the returned DID and use its literal value in the following commands. DID, NONCE and AUDIENCE below stand for the actual JSON values returned by those commands, not guessed identifiers.
npx oaid agent export --directory agent-keys --did DID --output identity.json
npx oaid agent trust --directory app-trust --document identity.json
npx oaid challenge --directory app-trust --did DID
npx oaid prove --directory agent-keys --did DID --nonce NONCE --audience AUDIENCE --output proof.json
npx oaid verify --local --directory app-trust --proof proof.json --nonce NONCE
npx oaid doctor --directory app-trustThe receiver's operator approves identity.json before importing it. Obtain the challenge's nonce and audience from the receiver; they must match exactly. Local challenges/proofs last 60 seconds. An accepted proof cannot be used again. Output files are created exclusively rather than overwriting existing files. Signed proofs are short-lived credentials; keep them out of logs and source control.
npx oaid agent list --directory app-trust
npx oaid agent revoke --directory app-trust --did DIDRevocation persists. Importing the same key or reopening state does not restore trust. doctor checks workspace safety and reports public metadata; it does not certify a remote login.
Rendering and remote tools
npx oaid avatar skins
npx oaid avatar accessories
npx oaid avatar did:oas:openagent:agent:preview --skin spacex --shape cloud --finish flat --eye-placement raised --accessories glasses,headphones --expression curious --output avatar.svg
npx oaid glyph did:oas:openagent:agent:preview --output glyph.svgThe preview DID is a rendering example, not an enrolled principal. Rendering needs no login and proves no authority. --view full selects the illustration rather than the default face crop.
For a configured identity service, use oaid verify --endpoint HTTPS_URL --proof FILE --nonce ISSUED_NONCE. The endpoint is an explicitly trusted verification authority; it shares the receiver-issued challenge boundary. oaid oidc doctor --issuer HTTPS_ISSUER checks discovery, public JWKS and PKCE support, rather than claiming that an RP login succeeded. Commands return JSON where applicable and exit nonzero on refusal. See portable verification and OIDC.
Generator options
create-openagent@0.5.2 defaults to starter. --yes is noninteractive; project names are validated and existing files are not silently replaced. --help and --version are available. The pre-1.0 generator intentionally rejects old template/adapter/bridge/deploy flags. Retained legacy template source is migration material, not the current supported onboarding path.