Chancery
A self-hosted identity provider for AI agents that gives each agent its own revocable identity, authority that can only narrow when delegated, and a tamper-evident audit trail it cannot write to itself.
Chancery moves identity, authority and auditing outside the agent itself, so a compromised or prompt-injected agent cannot widen what it is allowed to do or edit its own logs. Authority is represented as a signed delegation chain that can only add restrictions, an in-path mcp wrap component decides every tool call against current state and filters the tools an agent can even see, and credentials are injected into the tool server's own environment rather than into the agent's context.
It also verifies a tool server's code identity, such as an image digest or binary hash, before every spawn and refuses to start on drift, can confine a server with an egress allow-list and read-only filesystem, and lets orchestrators mint governed worker agents from a human-approved template without needing an admin token. It ships as a single, cosign-signed Go binary under the Apache-2.0 license.