Browse BYOAg

Implemented

Test observable behavior

Conformance is evidence, not a production claim

The repository includes draft JSON Schemas and an automated black-box development suite. It tests important 0.1 invariants while keeping the untested security and interoperability work visible.

Run the checks

Full suite or protocol-only

Fixtures generate fresh keys and credentials for each run. The repository contains definitions, not reusable private-key material.

All connector, MCP, and protocol tests

npm test

Black-box protocol suite only

npm run conformance

Draft schema set

Nine boundaries, independently inspectable

JSON Schema catches structural errors before semantic and cryptographic validation. A schema-valid document can still be unauthorized, expired, incorrectly signed, or bound to the wrong registration.

discovery.schema.json

Public platform metadata and endpoint advertisement.

jwks.schema.json

Public signing keys used by the 0.1 security profile.

pairing.schema.json

Begin, completion, confirmation, and registration message shapes.

delegation.schema.json

Platform maximum and user-narrowed authority.

engagement.schema.json

Signed, registration-bound operating context.

permission.schema.json

Operations, resources, effects, and handling constraints.

capability.schema.json

Versioned semantic action contracts and concrete mappings.

skill bundle.schema.json

Signed declarative skill manifest and content integrity.

plugin extension.schema.json

The proposed ai.byoag client extension manifest.

Covered invariants

What the development suite demonstrates

A compiled stdio MCP process publishes exactly the six bootstrap tools.
Exact-domain discovery, supported versions, same-origin JWKS, and signatures are enforced.
Post-signature discovery tampering is rejected.
Both code-is-consent and platform-confirmation pairing modes work.
Pairing-code expiration, replay prevention, and rate limiting behave as specified.
Pairwise identities differ across two independent hosts.
Credentials are key-bound and excluded from connector results.
DPoP proofs bind method, URI, token, time, and replay identifier.
Two simultaneous signed engagements validate independently.
Server revocation fails closed and disconnect preserves unrelated files.
Protected pairing-code references expire and are single use.

Validation layers

Passing a schema is only the first gate

01 · Shape
JSON Schema validation

Required fields, types, enumerations, and closed structures.
02 · Provenance
Signature and origin verification

Expected issuer, same-origin key set, signature profile, and content integrity.
03 · Context
Binding and lifetime checks

Registration, audience, role, delegation, expiration, and replay state.
04 · Runtime
Server authorization

Current policy and confirmation are evaluated again for every consequential call.

Deliberately outstanding

What the suite does not prove yet

These gaps are part of the project status. They should remain visible in implementation reviews and any claim about compatibility.

JWKS rotation and refresh after an unknown key
DPoP nonce challenge and retry behavior
DNS rebinding simulation
Multiple connector processes sharing one vault
Malicious signed-skill content and signature fixtures
Remote MCP capability filtering and invocation
OS-backed credential vault adapters
BYOAg Arena integration tests

Use the reference host

Exercise the protocol locally

The in-memory host creates deterministic, disposable protocol state and emits a loopback discovery domain plus a development pairing code.

npm run reference-host

# connector development setting
BYOAG_ALLOW_LOOPBACK=true

Contribution rule

Test behavior, not documentation prose

Add black-box assertions for observable security and isolation properties. Generate sensitive material at runtime, verify failure paths, and keep platform-specific assumptions out of the generic connector suite.

Browse the current tests