# Show HN: Arken – cryptographic identity for AI agents calling MCP servers/APIs

> Source: <https://github.com/arkenforge/arken-core>
> Published: 2026-11-02 04:29:23+00:00

The cryptographic core of ArkenForge. ECDSA signature verification, `did:key` identity, nonce generation.

`arken-core` is the Rust library that everything in ArkenForge builds on. It handles:

- **Challenge generation** — cryptographically random nonces with 60s TTL
- **Signature verification** — ECDSA secp256k1 via[ethers-rs](https://github.com/gakonst/ethers-rs)
- **DID parsing** —`did:key` identity using the W3C spec (`zQ3s…` prefix for secp256k1)

It compiles to a native shared library (`.dylib` / `.so` / `.dll`) loaded by higher-level packages via FFI.

Requires [Rust](https://rustup.rs).

```
cd rust
cargo build --release
```

Output: `rust/target/release/libarken_core.{dylib,so,dll}`

Three C-compatible functions are exported:

``` js
int generate_challenge_into(const char *statement, char *out, int cap);
int verify_request_into(const char *header, char *out, int cap);
int verify_signature_only_into(const char *header, char *out, int cap);
```

All functions write JSON into `out` and return the number of bytes written, or `-1` on buffer overflow.

An unsigned request gets a `401` with a one-time nonce. The client signs the nonce with its secp256k1 private key and retries with an `Authorization: Signature` header. The core verifies the ECDSA signature, checks the nonce, and returns the agent's `did:key` — nothing stored, nothing breached.

``` php
sequenceDiagram
    participant C as Client
    participant S as Server
    C->>S: GET /protected
    S-->>C: 401 { challenge: { nonce, statement } }
    Note over C: sign(nonce, privateKey)
    C->>S: GET /protected<br/>Authorization: Signature did="…",nonce="…",signature="…"
    S-->>C: 200 { did: "did:key:zQ3s…" }
```

Each agent gets a [W3C DID Key](https://w3c-ccg.github.io/did-method-key/) derived from its key pair:

```
did:key:zQ3shXgnkuyqVxf3NGBsK1q3J…
```

The `zQ3s…` prefix indicates secp256k1 (`0xe7 0x01` multicodec). Same key, same DID, across every server running Arken. One identity, every tool.

| Repo | What it is | 
|---|---|
| **arken-core** (this repo) | Rust crypto core — the foundation | 
| [arken-auth](https://github.com/arkenforge/arken-auth) | Express + FastAPI middleware, client SDKs, MCP integration | 
| [arken-registry](https://github.com/arkenforge/arken-registry) | Discovery registry — find APIs that accept Arken auth | 
| [arken-verifier](https://github.com/arkenforge/arken-verifier) | Hosted verifier — metered signature verification | 

- **Not production-ready.** Early-stage project.
- **Nonces are in memory.** Won't survive restarts or work across multiple instances without a shared store.
- **No key recovery.** Losing the private key means losing access.
- **Rust toolchain required to build.** Prebuilt binaries are on the 1.0 roadmap.

See [SECURITY.md](https://github.com/arkenforge/arken-core/blob/main/SECURITY.md). Find a flaw, open a private advisory, and your name goes in the Hall of Finders.

**Founding Builders** — everyone who joins before December 15, 2026 — are credited by name in the 1.0 README. There are **10 design-partner slots** for teams who want to shape the API directly.

[Apache 2.0](https://github.com/arkenforge/arken-core/blob/main/LICENSE) — ArkenForge