Liceat issues warrants — scoped, spend-capped, revocable grants of authority for AI agents. Verified offline in microseconds. Enforced at the point of action. Provable afterward, allow or deny. When an agent delegates to another agent, authority can only narrow — never escalate.
# run a complete authority gateway — dashboard, inspector, audit chain $ npx liceat serve # give an agent up to $50, payments only, for one hour $ liceat issue --principal org:acme --agent agent:booker \ --resource 'pay:*' --action pay --spend USD:5000 --ttl 3600 # put any MCP server behind enforcement — no server changes $ liceat-mcp --token CW1~… --label github -- npx -y @modelcontextprotocol/server-github
The way we give software authority was designed for code that does what it's told. Agents decide what to do — and today they do it holding your master credentials.
A warrant is a cryptographic capability token: the authority itself, carried by the agent, verifiable by anyone — no callback to us, no shared secrets.
Scope it to exact resources and actions. Cap cumulative spend. Set an expiry. Pin it to the agent's own key so a stolen copy is inert.
const { warrant } = issue(rootKey, kid, {
principal: 'org:acme', agent: 'agent:booker',
caveats: [
{ type: 'resource', patterns: ['pay:*'] },
{ type: 'action', actions: ['pay'] },
{ type: 'spend_limit', currency: 'USD', max: 5000 }, // $50, cumulative
{ type: 'expires', at: now + 3600 },
],
});
The gateway verifies the signature chain, evaluates every restriction against the concrete request — including spend already used — checks revocation, and only then lets the action through.
POST /call Authorization: Warrant CW1~… { "resource": "pay:stripe/charge", "action": "pay", "amount": 4000, "currency": "USD" } → 403 { "error": "denied", "reasons": ["spend limit exceeded: 2000+4000 > 5000 USD"] }
Every decision — allow or deny — lands in a hash-chained audit ledger. Anyone can re-verify the whole history; a single altered byte breaks the chain visibly.
GET /audit → { "chain": { "ok": true }, "head": "qB47sxTQ20…", "size": 6 }
An agent can hand a sub-agent a narrower warrant — read-only, one resource, ten cents — offline, without asking us. The math makes escalation impossible, not against policy: impossible.
const sub = attenuate(warrant, key, [{ type: 'action', actions: ['read'] }]);
// sub-agent tries to pay → denied. Its warrant provably ⊆ the parent.
Zero runtime dependencies. A frozen, openly specified wire format. And a system that attacks its own cryptography around the clock.
Multi-hop agent-to-agent delegation with authority that can only shrink. The unsolved problem in agent auth — solved with signatures, not policy files.
Any service verifies a warrant with just the issuer's public key. No auth server on the hot path, nothing to be down.
Limits enforced against everything the warrant has already spent — across every call, every sub-delegation — not just the request in hand.
Kill one warrant id and every sub-delegation derived from it dies instantly. No credential rotation, no collateral damage.
Pin a warrant to the agent's own key. A leaked token without the key is a bearer token that bears nothing.
Every decision, identity, and attestation is a leaf in a signed, append-only Merkle log — verify inclusion & append-only against our published key. Certificate-Transparency guarantees, no blockchain, no gas.
Register agents and issue revocable reputation/validation attestations on our own chain — the ERC-8004/EAS surface, gasless and instant. Emitted as W3C Verifiable Credentials with a did:web issuer.
Independent witnesses co-sign every checkpoint — but only across a verified consistency proof, so the operator can't even show two histories. The guarantee a hash chain alone can't give.
liceat-mcp -- <server> wraps any MCP server with enforcement and audit. Fail-closed. No server modification.
TypeScript and Python SDKs verified against the same frozen test vectors. The CW1 spec is public — implement it anywhere.
A built-in sentinel attacks the system's cryptographic invariants continuously and publishes the results — live, right now.
Verifying a warrant is free for everyone, forever. Everything below is fully self-serve — sign up, pay, and scale without ever talking to us.
A key or token says who is calling; everything it can do rides along, all or nothing, and only the issuing server can check it. A warrant carries what is permitted — resources, actions, spend, time — inside a signed chain anyone can verify offline. And unlike OAuth scopes, a holder can delegate a provably narrower warrant to another agent without a round-trip to the issuer.
Three independent safety nets: warrants expire; revoking the root id instantly kills it and every sub-delegation; and a holder-bound warrant requires the presenter to sign each request with the agent's own private key — the stolen token alone authorizes nothing. Every attempted use, either way, is in the audit chain.
No — and not as a matter of policy, as a matter of arithmetic. Delegation appends restrictions to a signature chain; verification evaluates the intersection of all of them. Removing or weakening a restriction breaks the chain cryptographically. This invariant is fuzzed continuously by our built-in sentinel and checked by the public test vectors.
Paste it into the Warrant Inspector. You'll see who delegated it, to which agent, exactly what it permits, how it has been narrowed at each hop, and whether the chain and revocation status are sound.
The CW1 wire format is frozen and publicly specified with normative test vectors — any incompatible change would ship as CW2, never silently. The implementation is source-available (BSL 1.1, free for development and internal use, converting to Apache 2.0). Verification is free for everyone, always.
Sign up at the portal for an instant API key with 10,000 free decisions.
After that it's $0.0001 per authorization — pay by card, or with USDC on Base: request an
invoice, send the exact amount, and credits land automatically on confirmation. When an account
runs dry the gateway answers 402 with machine-readable payment options (x402-style),
so an agent holding a wallet can literally top up its own authority budget. No invoices by email,
no sales calls, no humans required on either side.
Only if you want them to. Self-hosted gateways run entirely on your infrastructure, and offline verification means any service you control can check warrants locally with the issuer's public key.