{"slug": "show-hn-arken-cryptographic-identity-for-ai-agents-calling-mcp-servers-apis", "title": "Show HN: Arken – cryptographic identity for AI agents calling MCP servers/APIs", "summary": "ArkenForge released arken-core, an Apache 2.0 Rust library that gives AI agents calling MCP servers and APIs a cryptographic identity via ECDSA secp256k1 signature verification and W3C did:key identifiers. The library exports three C-compatible functions — generate_challenge_into, verify_request_into and verify_signature_only_into — issuing 60-second nonces and returning the agent's did:key after a signed Authorization: Signature retry. ArkenForge states the project is not production-ready, keeps nonces in memory so they do not survive restarts or work across multiple instances without a shared store, and offers no key recovery.", "body_md": "The cryptographic core of ArkenForge. ECDSA signature verification, `did:key` identity, nonce generation.\n\n`arken-core` is the Rust library that everything in ArkenForge builds on. It handles:\n\n- **Challenge generation** — cryptographically random nonces with 60s TTL\n- **Signature verification** — ECDSA secp256k1 via[ethers-rs](https://github.com/gakonst/ethers-rs)\n- **DID parsing** —`did:key` identity using the W3C spec (`zQ3s…` prefix for secp256k1)\n\nIt compiles to a native shared library (`.dylib` / `.so` / `.dll`) loaded by higher-level packages via FFI.\n\nRequires [Rust](https://rustup.rs).\n\n```\ncd rust\ncargo build --release\n```\n\nOutput: `rust/target/release/libarken_core.{dylib,so,dll}`\n\nThree C-compatible functions are exported:\n\n``` js\nint generate_challenge_into(const char *statement, char *out, int cap);\nint verify_request_into(const char *header, char *out, int cap);\nint verify_signature_only_into(const char *header, char *out, int cap);\n```\n\nAll functions write JSON into `out` and return the number of bytes written, or `-1` on buffer overflow.\n\nAn unsigned request gets a `401` with a one-time nonce. The client signs the nonce with its secp256k1 private key and retries with an `Authorization: Signature` header. The core verifies the ECDSA signature, checks the nonce, and returns the agent's `did:key` — nothing stored, nothing breached.\n\n``` php\nsequenceDiagram\n    participant C as Client\n    participant S as Server\n    C->>S: GET /protected\n    S-->>C: 401 { challenge: { nonce, statement } }\n    Note over C: sign(nonce, privateKey)\n    C->>S: GET /protected<br/>Authorization: Signature did=\"…\",nonce=\"…\",signature=\"…\"\n    S-->>C: 200 { did: \"did:key:zQ3s…\" }\n```\n\nEach agent gets a [W3C DID Key](https://w3c-ccg.github.io/did-method-key/) derived from its key pair:\n\n```\ndid:key:zQ3shXgnkuyqVxf3NGBsK1q3J…\n```\n\nThe `zQ3s…` prefix indicates secp256k1 (`0xe7 0x01` multicodec). Same key, same DID, across every server running Arken. One identity, every tool.\n\n| Repo | What it is | \n|---|---|\n| **arken-core** (this repo) | Rust crypto core — the foundation | \n| [arken-auth](https://github.com/arkenforge/arken-auth) | Express + FastAPI middleware, client SDKs, MCP integration | \n| [arken-registry](https://github.com/arkenforge/arken-registry) | Discovery registry — find APIs that accept Arken auth | \n| [arken-verifier](https://github.com/arkenforge/arken-verifier) | Hosted verifier — metered signature verification | \n\n- **Not production-ready.** Early-stage project.\n- **Nonces are in memory.** Won't survive restarts or work across multiple instances without a shared store.\n- **No key recovery.** Losing the private key means losing access.\n- **Rust toolchain required to build.** Prebuilt binaries are on the 1.0 roadmap.\n\nSee [SECURITY.md](https://github.com/arkenforge/arken-core/blob/main/SECURITY.md). Find a flaw, open a private advisory, and your name goes in the Hall of Finders.\n\n**Founding Builders** — everyone who joins before December 15, 2026 — are credited by name in the 1.0 README. There are **10 design-partner slots** for teams who want to shape the API directly.\n\n[Apache 2.0](https://github.com/arkenforge/arken-core/blob/main/LICENSE) — ArkenForge", "url": "https://wpnews.pro/news/show-hn-arken-cryptographic-identity-for-ai-agents-calling-mcp-servers-apis", "canonical_source": "https://github.com/arkenforge/arken-core", "published_at": "2026-11-02 04:29:23+00:00", "updated_at": "2026-11-02 04:51:04.362996+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-tools", "developer-tools"], "entities": ["ArkenForge", "arken-core", "arken-auth", "arken-registry", "arken-verifier", "ethers-rs", "W3C"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-arken-cryptographic-identity-for-ai-agents-calling-mcp-servers-apis", "markdown": "https://wpnews.pro/news/show-hn-arken-cryptographic-identity-for-ai-agents-calling-mcp-servers-apis.md", "text": "https://wpnews.pro/news/show-hn-arken-cryptographic-identity-for-ai-agents-calling-mcp-servers-apis.txt", "jsonld": "https://wpnews.pro/news/show-hn-arken-cryptographic-identity-for-ai-agents-calling-mcp-servers-apis.jsonld"}}