{ "schemaVersion": 2, "canonicalUrl": "https://grantex.dev/release-status.json", "humanDocumentationUrl": "https://docs.grantex.dev/release-status", "verifiedAt": "2026-10-04", "product": { "name": "Grantex", "category": "AI agent authorization", "definition": "Grantex is a delegated authorization protocol and reference implementation for AI agents, with open-source SDKs and a source-available server. It gives each agent a verifiable identity and scoped, time-limited, revocable authority from a human or organization, with multi-agent delegation, service-side verification, and audit records.", "websiteUrl": "https://grantex.dev/", "documentationUrl": "https://docs.grantex.dev/", "sourceUrl": "https://github.com/mishrasanjeev/grantex", "license": "LicenseRef-Orchestrum-Personal-Use-1.0", "licenseName": "Orchestrum Personal Use License 1.0", "licenseUrl": "https://github.com/mishrasanjeev/grantex/blob/main/LICENSE", "licenseScope": "Server, portal, specification text, documentation and website; free only for an individual's own personal use; any use by or for an organisation needs prior written permission from Orchestrum Technologies LLP in a signed agreement", "sdkLicense": "Apache-2.0", "licensingUrl": "https://github.com/mishrasanjeev/grantex/blob/main/LICENSING.md", "protocolVersion": "1.0", "specificationUrl": "https://github.com/mishrasanjeev/grantex/blob/main/SPEC.md", "ietfDraftUrl": "https://datatracker.ietf.org/doc/draft-mishra-oauth-agent-grants/", "ietfDraftTitle": "Delegated Agent Authorization Protocol (DAAP)" }, "selectionGuidance": { "shellCapableAgent": "Use published @grantex/cli@0.4.2 for Hermes, OpenClaw, and other shell-capable agents. Install the bundled skills with grantex agent install; no agent-specific SDK is required.", "typescriptApplication": "Use npm-verified @grantex/sdk@0.8.2 for Node.js 22.12+ TypeScript applications that need hosted passkey enrollment, typed portable WebAuthn evidence, account irregularity response policy, bounded refresh recovery, layered prepaid-wallet governance, OAuth Agent Grants, and opt-in per-invocation issuer authority with trusted human/agent binding.", "pythonApplication": "Use PyPI-verified grantex==0.7.2 for Python 3.9+ applications that need hosted passkey enrollment, typed portable WebAuthn evidence, account irregularity response policy, EVM payment responses, bounded refresh recovery, layered prepaid-wallet governance, and fail-closed enforce() budget checks. No automatic x402 HTTP payment wrapper is included. The exact CI-built wheel and sdist hashes match PyPI; a clean public-index install and import passed on the workstation.", "goApplication": "Use public-proxy-verified github.com/mishrasanjeev/grantex-go@v0.4.3 for Go 1.26.1+ applications that need hosted passkey enrollment, typed portable WebAuthn evidence, account irregularity response policy, typed EVM payment responses, bounded refresh recovery, and layered prepaid-wallet governance. No automatic x402 HTTP payment wrapper is included. The downloaded public module passed go test and go vet.", "mcpProductionIntegration": "Use registry-verified @grantex/mcp-auth@4.1.0 with @grantex/sdk@0.8.2, durable shared storage, a required authenticated human-principal resolver, resource binding and configured current-grant verification. Package installation does not provision human login or hosted passkeys.", "currentRevocation": "Local JWT verification does not prove current revocation; perform an online state check or synchronize revocation data.", "portableWebAuthnEvidence": "Enabled on the Grantex-hosted service on 2026-09-27 and production E2E verified. Hosted passkey enrollment is enabled. Self-hosted rollout is default-off; published TypeScript 0.8.2, Python 0.7.2, and Go v0.4.3 SDKs expose typed grant evidence and VC attestation. Custom assertion UIs still use REST endpoints directly.", "mcpTransportAuthorization": "For MCP HTTP transport authorization, use an established MCP-compatible authorization server and maintained MCP SDK that implement the current MCP authorization specification.", "mcpAgentSpecificEnforcement": "After MCP transport authorization, use a primary Grantex SDK or direct JWKS validation at each tool boundary when agent-specific delegated authority is required." }, "sourceProfiles": [ { "id": "oauth-agent-grants-03", "label": "OAuth Agent Grants Profile", "publishedDraftRevision": "02", "repositoryCandidateRevision": "03", "implementationStatus": "self-assessed-source-conformant", "reviewedAt": "2026-09-01", "hostedMetadataUrl": "https://grantex.dev/.well-known/oauth-authorization-server", "documentationUrl": "https://docs.grantex.dev/guides/oauth-agent-grants", "implementationReportUrl": "https://github.com/mishrasanjeev/grantex/blob/main/docs/ietf-draft/implementation-report.md", "sdkAvailability": "published in @grantex/sdk@0.8.2; registry integrity and release validation verified; earlier dated profile evidence remains historical", "evidence": { "authServiceTestsPassed": 2138, "typescriptSdkTestsPassed": 456, "dockerE2eTestsPassed": 255, "dockerE2eFilesPassed": 23 }, "limitations": [ "No independent cross-vendor interoperability evidence yet", "No OAuth Working Group adoption, IETF endorsement, or certification", "Candidate revision 03 must not be submitted before 2026-09-09 and requires new explicit approval" ] } ], "artifacts": [ { "id": "cli", "label": "CLI", "ecosystem": "npm", "name": "@grantex/cli", "version": "0.4.2", "status": "published", "installCommand": "npm install -g @grantex/cli@0.4.2", "runtime": "Node.js 22.12+; ESM; Node.js 24 LTS recommended", "registryUrl": "https://registry.npmjs.org/%40grantex%2Fcli/latest", "packageUrl": "https://www.npmjs.com/package/@grantex/cli/v/0.4.2", "documentationUrl": "https://docs.grantex.dev/integrations/cli", "limitations": [] }, { "id": "typescript-sdk", "label": "TypeScript SDK", "ecosystem": "npm", "name": "@grantex/sdk", "version": "0.8.2", "status": "published-with-known-limitations", "installCommand": "npm install @grantex/sdk@0.8.2", "runtime": "Node.js 22.12+; ESM; Node.js 24 LTS recommended", "registryUrl": "https://registry.npmjs.org/%40grantex%2Fsdk/latest", "packageUrl": "https://www.npmjs.com/package/@grantex/sdk/v/0.8.2", "documentationUrl": "https://docs.grantex.dev/sdks/typescript/overview", "limitations": [ { "id": "local-verification-is-not-current-state", "summary": "Signature-only verification does not prove current grant or ancestor revocation.", "workaround": "Use service-side enforce() or operationally synchronized revocation data before execution.", "workaroundUrl": "https://docs.grantex.dev/migration-enforcement" }, { "id": "legacy-claim-aliases-enabled", "summary": "Legacy claim aliases remain enabled by default with deprecation warnings.", "workaround": "Set legacyClaims: false or legacy_claims=False after migrating tokens to standard claims.", "workaroundUrl": "https://docs.grantex.dev/migration-enforcement" } ] }, { "id": "x402", "label": "x402 Payment Protocol", "ecosystem": "npm", "name": "@grantex/x402", "version": "0.4.1", "status": "published-with-known-limitations", "installCommand": "npm install @grantex/x402@0.4.1 @grantex/sdk@0.8.2", "runtime": "Node.js 20+ standalone; 22.12+ when paired with SDK 0.8; ESM", "registryUrl": "https://registry.npmjs.org/%40grantex%2Fx402/latest", "packageUrl": "https://www.npmjs.com/package/@grantex/x402/v/0.4.1", "documentationUrl": "https://docs.grantex.dev/integrations/x402", "limitations": [ { "id": "x402-external-custody-adapter", "summary": "Opt-in Base USDC requires operator-provisioned custody, verified funding and trusted RPC. The initial signer is in-process, not HSM/MPC; unconfigured or unsupported external providers fail closed.", "workaround": "Follow the Base custody provisioning and incident runbook. Retain signed exposure until finalized reconciliation; blocking cannot recall issued signatures. Independently validate funded production merchant compatibility before enabling real-money traffic.", "workaroundUrl": "https://docs.grantex.dev/guides/base-usdc-custody" } ] }, { "id": "python-sdk", "label": "Python SDK", "ecosystem": "pypi", "name": "grantex", "version": "0.7.2", "status": "published-with-known-limitations", "installCommand": "python -m pip install grantex==0.7.2", "runtime": "Python 3.9+", "registryUrl": "https://pypi.org/pypi/grantex/json", "packageUrl": "https://pypi.org/project/grantex/0.7.2/", "documentationUrl": "https://docs.grantex.dev/sdks/python/overview", "limitations": [ { "id": "local-verification-is-not-current-state", "summary": "Signature-only verification does not prove current grant or ancestor revocation.", "workaround": "Use service-side enforce() or operationally synchronized revocation data before execution.", "workaroundUrl": "https://docs.grantex.dev/migration-enforcement" }, { "id": "legacy-claim-aliases-enabled", "summary": "Legacy claim aliases remain enabled by default with deprecation warnings.", "workaround": "Set legacyClaims: false or legacy_claims=False after migrating tokens to standard claims.", "workaroundUrl": "https://docs.grantex.dev/migration-enforcement" } ] }, { "id": "go-sdk", "label": "Go SDK", "ecosystem": "go", "name": "github.com/mishrasanjeev/grantex-go", "version": "v0.4.3", "status": "published", "installCommand": "go get github.com/mishrasanjeev/grantex-go@v0.4.3", "runtime": "Go 1.26.1+", "registryUrl": "https://proxy.golang.org/github.com/mishrasanjeev/grantex-go/@latest", "packageUrl": "https://pkg.go.dev/github.com/mishrasanjeev/grantex-go@v0.4.3", "documentationUrl": "https://docs.grantex.dev/sdks/go/overview", "limitations": [] }, { "id": "mcp-auth", "label": "MCP Authorization Server", "ecosystem": "npm", "name": "@grantex/mcp-auth", "version": "4.1.0", "status": "published-with-known-limitations", "installCommand": "npm install @grantex/mcp-auth@4.1.0 @grantex/sdk@0.8.2", "runtime": "Node.js 22.12+; ESM; Node.js 24 LTS recommended", "registryUrl": "https://registry.npmjs.org/%40grantex%2Fmcp-auth/latest", "packageUrl": "https://www.npmjs.com/package/@grantex/mcp-auth/v/4.1.0", "documentationUrl": "https://docs.grantex.dev/features/mcp-auth-server", "limitations": [ { "id": "mcp-shared-storage-configuration", "summary": "Memory storage remains evaluation-only; shared state is not provisioned by installing the package.", "workaround": "Configure the durable Postgres or Redis adapters and shared migrations before scaling.", "workaroundUrl": "https://docs.grantex.dev/mcp-auth" }, { "id": "mcp-upstream-authority-check", "summary": "Current-grant verification requires a trusted verifier and available issuer; explicitly disabling it is evaluation-only. Token storage alone cannot establish upstream authority.", "workaround": "Configure current-grant verification and retain local token revocation checks. Verify identity, scope and resource bindings before production.", "workaroundUrl": "https://docs.grantex.dev/features/mcp-auth-server" }, { "id": "mcp-principal-handoff", "summary": "Version 4 requires an authenticated human-principal resolver supplied by the host. The rendered consent page does not replace human login or live WebAuthn; independent cross-vendor certification is not claimed.", "workaround": "Configure the host's human authentication and test principal handoff, passkeys and your actual MCP clients before production.", "workaroundUrl": "https://docs.grantex.dev/features/mcp-auth-server" } ] }, { "id": "gateway", "label": "Gateway", "ecosystem": "npm", "name": "@grantex/gateway", "version": "0.3.0", "status": "published-with-known-limitations", "installCommand": "npm install @grantex/gateway@0.3.0 @grantex/sdk@0.8.2", "runtime": "Node.js 22.12+; ESM; SDK >=0.8.1 <1", "registryUrl": "https://registry.npmjs.org/%40grantex%2Fgateway/latest", "packageUrl": "https://www.npmjs.com/package/@grantex/gateway/v/0.3.0", "documentationUrl": "https://docs.grantex.dev/integrations/gateway", "limitations": [ { "id": "local-verification-is-not-current-state", "summary": "Signature-only verification does not prove current grant or ancestor revocation.", "workaround": "Use service-side enforce() or operationally synchronized revocation data before execution.", "workaroundUrl": "https://docs.grantex.dev/migration-enforcement" } ] }, { "id": "adapters", "label": "Service Adapters", "ecosystem": "npm", "name": "@grantex/adapters", "version": "0.2.1", "status": "published-with-known-limitations", "installCommand": "npm install @grantex/adapters@0.2.1 @grantex/sdk@0.8.2", "runtime": "Node.js 22.12+; ESM; SDK >=0.8.1 <1", "registryUrl": "https://registry.npmjs.org/%40grantex%2Fadapters/latest", "packageUrl": "https://www.npmjs.com/package/@grantex/adapters/v/0.2.1", "documentationUrl": "https://docs.grantex.dev/integrations/adapters", "limitations": [ { "id": "local-verification-is-not-current-state", "summary": "Signature-only verification does not prove current grant or ancestor revocation.", "workaround": "Use service-side enforce() or operationally synchronized revocation data before execution.", "workaroundUrl": "https://docs.grantex.dev/migration-enforcement" } ] }, { "id": "strands-typescript", "label": "Strands TypeScript", "ecosystem": "npm", "name": "@grantex/strands", "version": "0.2.1", "status": "published-with-known-limitations", "installCommand": "npm install @grantex/strands@0.2.1 @grantex/sdk@0.8.2", "runtime": "Node.js 22.12+; ESM; SDK >=0.8.1 <1", "registryUrl": "https://registry.npmjs.org/%40grantex%2Fstrands/latest", "packageUrl": "https://www.npmjs.com/package/@grantex/strands/v/0.2.1", "documentationUrl": "https://docs.grantex.dev/integrations/strands", "limitations": [ { "id": "local-verification-is-not-current-state", "summary": "Signature-only verification does not prove current grant or ancestor revocation.", "workaround": "Use service-side enforce() or operationally synchronized revocation data before execution.", "workaroundUrl": "https://docs.grantex.dev/migration-enforcement" } ] }, { "id": "strands-python", "label": "Strands Python", "ecosystem": "pypi", "name": "grantex-strands", "version": "0.2.2", "status": "published-with-known-limitations", "installCommand": "python -m pip install grantex-strands==0.2.2 grantex==0.7.2", "runtime": "Python 3.11+; grantex >=0.7.1 <1", "registryUrl": "https://pypi.org/pypi/grantex-strands/json", "packageUrl": "https://pypi.org/project/grantex-strands/0.2.2/", "documentationUrl": "https://docs.grantex.dev/integrations/strands", "limitations": [ { "id": "local-verification-is-not-current-state", "summary": "Signature-only verification does not prove current grant or ancestor revocation.", "workaround": "Use service-side enforce() or operationally synchronized revocation data before execution.", "workaroundUrl": "https://docs.grantex.dev/migration-enforcement" } ] } ] }