Sdk

io.github.bolyraPublished by GitHub account bolyrav0.5.2Updated Oct 24, 2026

TypeScript SDK for mutual ZKP authentication between humans and AI agents.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local TypeScript SDK for Bolyra that gives an assistant building blocks for mutual zero-knowledge-proof authentication between humans and AI agents.

What you can do
Create human identities and agent credentials with permission bitmasks, including delegation and validation helpers, and generate mutual handshake proofs between a human and an agent, then verify them locally and read the resulting nullifier and scope commitment. Use low-level Poseidon hashing and BabyJubjub EdDSA signing, verification and public-key derivation for custom verifiers or commitment recomputation. Submit proofs to an on-chain registry through ethers.js.
When to use it
Worth adding when you are building or testing Bolyra-based agent authorization flows and want an assistant to scaffold identity creation, permission encoding, handshake proving and verification, or external verifier logic in TypeScript.
Requirements
Runs as a local stdio process on desktop; installed from the npm package @bolyra/sdk, so Node.js and npm are needed. No authentication, environment variables or headers are declared. On-chain verification requires ethers.js and a registry contract, and handshake proving is described as taking roughly 16 seconds.
Before you install
The SDK handles private keys: agent credentials are created from an operator private key, and the README's example passes it directly. Permission tiers include financial spending limits up to unlimited and sign-on-behalf and sub-delegation rights, so misconfigured bitmasks grant broad authority. Submitting proofs to a chain writes data and may cost gas. No tools are listed in the manifest, so confirm what the server actually exposes.

Installation

In SourceWeft

  1. Open Sdk in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@bolyra/sdk

TypeScript SDK for Bolyra — mutual ZKP authentication for humans and AI agents.

New here? Start with the 5-minute Quickstart — from npm install to on-chain verification.

Install

bash
npm install @bolyra/sdk

Quick Start

typescript
import {  createHumanIdentity,  createAgentCredential,  Permission,  proveHandshake,  verifyHandshake,} from '@bolyra/sdk';
// 1. Create identitiesconst human = await createHumanIdentity(123456789n);const agent = await createAgentCredential(  12345n,  operatorPrivateKey,  [Permission.READ_DATA, Permission.WRITE_DATA],  BigInt(Math.floor(Date.now() / 1000) + 86400),);
// 2. Generate mutual handshake proofs (parallel, ~16s)const { humanProof, agentProof, nonce } = await proveHandshake(human, agent);
// 3. Verify locallyconst result = await verifyHandshake(humanProof, agentProof, nonce);console.log('Verified:', result.verified); // trueconsole.log('Human nullifier:', result.humanNullifier);console.log('Agent scope commitment:', result.scopeCommitment);
// 4. Submit to chain (via ethers.js)// await registry.verifyHandshake(humanProof, agentProof, nonce);

Low-level primitives (v0.6.0+)

For advanced use — e.g. building an external verifier or recomputing credential/scope commitments — the SDK exports its Poseidon hashes and BabyJubjub EdDSA primitives:

typescript
import { poseidon5, eddsaSign, eddsaVerify, derivePublicKey } from '@bolyra/sdk';
const pub = await derivePublicKey(operatorPrivateKey);   // { x, y }const sig = await eddsaSign(operatorPrivateKey, message); // { R8: { x, y }, S }const ok  = await eddsaVerify(pub, message, sig);         // booleanconst h   = await poseidon5(a, b, c, d, e);               // bigint

eddsaVerify returns false (never throws) on malformed input. See @bolyra/cli's bolyra verify for a full external-verifier reference.

Permissions

Permissions use cumulative bit encoding — higher tiers imply lower ones:

BitPermissionNotes
0READ_DATA
1WRITE_DATA
2FINANCIAL_SMALL< $100
3FINANCIAL_MEDIUM< $10,000 (implies bit 2)
4FINANCIAL_UNLIMITEDUnlimited (implies 2+3)
5SIGN_ON_BEHALF
6SUB_DELEGATE
7ACCESS_PII

API Status

FunctionStatus
createHumanIdentity()v0.1
createAgentCredential()v0.1
permissionsToBitmask()v0.1
validateCumulativeBitEncoding()v0.1
proveHandshake()v0.2
verifyHandshake()v0.2
delegate()v0.3
verifyDelegation()v0.3

License

Apache-2.0 — see LICENSE.

Source: sdk/README.md at commit 5e9de85

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.5.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts