ATC/1.0 — Agent Trust Card
ATC/1.0 is a formal, versioned, testable specification for Agent Trust Cards — cryptographic credentials that let AI agents prove their identity, declare their capabilities, and carry their security audit evidence. Any peer agent can verify them offline without calling home.
Think of it as SSL certificates for AI agents.
The 8 required controls
ATC/1.0 covers identity, attestation, capabilities, evidence, risk, signature, revocation, and expiration.
| # | ID | What it covers |
|---|---|---|
| 1 | ATC-001 | Identity |
| 2 | ATC-002 | Attestation (Ed25519 + CA) |
| 3 | ATC-003 | Capabilities (5 categories) |
| 4 | ATC-004 | Evidence (audit pipeline output) |
| 5 | ATC-005 | Risk (trust score 0-10) |
| 6 | ATC-006 | Signature (Ed25519 + RFC 8785 JCS + SHA-256) |
| 7 | ATC-007 | Revocation (ocsp/crl/simple_json) |
| 8 | ATC-008 | Expiration (issued_at, expires_at) |
Quick start (5 minutes)
Install the SDK and issue your first ATC:
npm install agent-trust-cardimport {
generateKeyPair,
issueATC,
verifyATC
} from 'agent-trust-card';
const ca = generateKeyPair();
const agent = generateKeyPair();
const atc = issueATC(ca, agent, {
card_id: 'ATC-2026-0000001',
identity: { /* ... */ },
capabilities: { /* ... */ },
evidence: { /* ... */ },
risk: { trust_score: 9, /* ... */ },
});
const result = await verifyATC(atc, {
fetch_revocation: true
});
console.log(result.valid); // → trueOr try the browser playground (zero install, uses WebCrypto).
3 SDKs available
Same ATC format, same signatures — cross-language compatible.
Live resources
Everything you need to verify the implementation works:
Why ATC/1.0 exists
The market is converging on agent trust infrastructure from multiple directions — Microsoft AutoGen, OpenAI Cookbook, A2A Agent Cards, OpenA2A AIP, OATI, and others. ATC/1.0 is the first formal, versioned, testable specification for Agent Trust Cards.
See the prior art timeline for the honest chronology of ATC and adjacent work. We acknowledge prior work (A2A Agent Card, AgentCards, OpenA2A AIP, OATI) and do not claim to have invented "agent identity" — we claim to have shipped the first formal spec.
The question is no longer "who thought of agent trust first" — multiple parties did. The question is "who shipped a formal, versioned, testable specification first" — and the answer is ATC/1.0, dated 2026-08-10.
Badges
If your project implements ATC/1.0, add this badge to your README:
[](https://marketnow.site/atc/conformance)
Conformance
A conformant ATC/1.0 implementation MUST pass all 8 required controls. The conformance test suite has 23 assertions across 8 test cases, all passing:
- PASS Test 1: Valid ATC verifies all 8 controls
- PASS Test 2: Tampered payload fails ATC-006
- PASS Test 3: Wrong CA key fails ATC-006
- PASS Test 4: Invalid card_id format
- PASS Test 5: Invalid capability enum
- PASS Test 6: Trust score out of range
- PASS Test 7: ATC expired
- PASS Test 8: Missing required fields
Try it now — verify a real ATC against the live MarketNow CA
The MarketNow Sentinel CA has issued 57 real ATCs (3 revoked). You can verify any of them against the open spec:
curl https://marketnow.site/api/atc?action=verify&card_id=ATC-2026-7777670Or use the SDK:
import { verifyATC } from 'agent-trust-card';
const res = await fetch('https://marketnow.site/api/atc?action=verify&card_id=ATC-2026-7777670');
const atc = await res.json();
const result = await verifyATC(atc, { fetch_revocation: true });
console.log(result.valid); // → true
console.log(result.controls_passed.length); // → 8
console.log(result.revoked); // → false