ATTP is a synchronous request-response protocol for AI agents calling web APIs. Runs over HTTP with mandatory ECDSA P-256 signing, agent identity passports, trust-gated access
(L0-L4), and built-in audit trails. No insecure mode.
npm install @proofxhq/attp -- zero deps. One line server middleware: app.use(attp.verify()). One line client: attp.fetch('attp://api.example.com/v1/data').
IETF Internet-Draft submitted: https://datatracker.ietf.org/doc/draft-sharif-attp-agent-trust-transport/
Part of 6 IETF drafts covering agent security. OWASP MCP Security Cheat Sheet aligned. OpenAPI extension registered.
ATTP is a synchronous request-response protocol for AI agents calling web APIs. Runs over HTTP with mandatory ECDSA P-256 signing, agent identity passports, trust-gated access (L0-L4), and built-in audit trails. No insecure mode.