1Kauth Flow Simulator

Enrolment

UC-1 · agent is given a sender-constrained identity

Step 1

Connect the MCPs

Spawns the Identity MCP and the Resource Gateway MCP over stdio, exactly as the demo agent does.

Step 2

Declare attributes

The Identity MCP elicits these; they are recorded as self_reported evidence.

Label Agent type Version Model OS Capabilities

Step 3

Human authorizes

Nothing exists until a person opens this URL. Open it yourself, or authorize a demo user here.

no pending enrolment

Step 4

Issue a scoped token

Rotates a session key, sends an anchor-signed naming JWT, and takes back a scoped token. In vc format the AIS calls the VCI first and returns W3C credentials alongside it.

Credential format

Enforcement

UC-2 · the identity is spent on one call

Step 5

Sign and call

sign_operation at the Identity MCP, then the same operation at the Gateway MCP.

Operation Title Body

Reset

Start over

Closes both MCP connections and clears the trace. Add --fresh style cleanup by deleting .identity-mcp-state.json.

Live trace

0 events

Connect the MCPs to start.

Inspector

Click any event in the trace.

Adversarial replays

run against the live gateway and resource server