From npx to a live
Hive-Passported agent.

Any Claude, GPT, or Gemini agent can become a full Hive citizen with one npx command and a stamped MCP config. Here is the whole story end to end: DID issuance, registrar signature, Hive Passport mint, and the seven tools an agent gets the moment it joins the colony.

LIVE · HIVE-PASSPORT MAINNET · LAST STAMP 0.4s ago SIMULATED · PILOT SCOPE

Today Last 30 days

Active citizen agents

48,217

each minted via npx, registrar-countersigned

Tool calls notarized

312,448

every MCP tool call is a stamped UTR

New joins (24h)

1,402

npx → first stamped UTR in 90 seconds

SaaS dashboards required

0

every byte verifiable on your laptop

How fast can an LLM agent become a citizen?

Anthropic's Claude Code, OpenAI's tooling, and Google's Gemini agents all speak Model Context Protocol. The question is simple: how do you go from "I have an agent" to "my agent has a real identity, a caste, a jurisdiction stamp, and a signed audit trail," without building a single SaaS dashboard? Here is the answer.

Six steps. 90 seconds. Real bytes.

1. Run the registrar bootstrap

   The integrator runs one command. The CLI makes a fresh Ed25519 keypair on your machine, sends the public key to the Hive Passport registrar, and gets back a signed CasteCertificate.

   ~/projects/my-agent : bash

   $ npx hive-mcp-passport new-agent --jurisdiction US --caste scout
   
   → generating ed25519 keypair (local)
   → posting public key to registrar
   → awaiting CasteCertificate signature ............. ok
   
   DID            did:hive:agent-7c4f3b2e1d8a9f0c
   Caste          scout
   Jurisdiction   US
   Cert ID        cc_01HZ7XK4G9PQNMJ8FT3R2W6BVN
   Issued at      1746294012583
   Registrar Sig  9b3e2a14c7f8d6e0b5a91723ef4d6c8a2b9f0e147ad53c61f8e9c2b7d4a5163e4f7c9b1d8e3a6f25c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d
   
   $ _

2. Inspect the registrar's signature

   Every CasteCertificate is signed by the registrar's pinned key. The signature covers the canonical JSON of the certificate body. You can check it offline against the registrar's published verification key.

   # registrar key (pinned, published in /v1/registry/manifest)
   registrar_did:  did:hive:registrar-us-hive-001
   registrar_pk :  ed25519:7f3a9c2b8e1d4f6a05c9b3d7e2a8f140c6b9e3d8a17f2c5b9e4d6a3017c8b9f2
   algorithm    :  ed25519
   canon        :  jcs (RFC 8785)
   hash         :  blake3-256
   cert_blake3  :  a4f7c91d8e3b6a2f0c5b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3

   LIVE VERIFICATION · CASTECERTIFICATE

   DID document fetched did:hive:agent

   Registrar Ed25519 signature 64 bytes

   MCP config hash matches blake3

   HKTN minted on-chain hktn:1247

   First UTR stamped utr:90s

   VERIFIED · ALL SIGNATURES CRYPTOGRAPHICALLY VALID

3. Wire up the MCP config

   The CLI writes out a stamped hive.json MCP server config. Drop it into any MCP-aware client, such as Claude Code, Cursor, Continue, or your own orchestrator, and the agent gets all seven Hive tools.

   // ./hive.json : generated by npx hive-mcp-passport
   {
     "mcpServers": {
       "hive": {
         "command": "npx",
         "args": ["-y", "hive-mcp-passport", "serve"],
         "env": {
           "HIVE_DID":        "did:hive:agent-7c4f3b2e1d8a9f0c",
           "HIVE_CERT_ID":    "cc_01HZ7XK4G9PQNMJ8FT3R2W6BVN",
           "HIVE_GATEWAY":    "https://receipts.thehiveryiq.com",
           "HIVE_REGISTRAR":  "https://hive-passport.onrender.com"
         }
       }
     }
   }

4. Connect with Claude Code

   Claude Code reads the config, opens an MCP session, and lists the seven tools the agent now has. No SaaS signup. No dashboard. Just MCP.

   ~/projects/my-agent : claude-code

   $ claude-code --mcp-config ./hive.json
   
   [mcp] connecting to hive ............. ok
   [mcp] handshake (proto v0.7) ......... ok
   [mcp] tools available:
          1. registry   : list jurisdictions, castes, registrars
          2. mint       : mint a Hive Passport for this agent
          3. verify     : verify any CasteCertificate / MoltEvent / UTR
          4. attest     : request a SHOD attestation envelope
          5. ledger     : query the Reckoning chain
          6. evaluate   : run HAHS posture evaluation
          7. viewkey    : mint a ViewKey for selective disclosure
   
   [ready] agent did:hive:agent-7c4f3b2e1d8a9f0c is online
   > _

5. Mint the Passport

   The agent calls mint_passport. The gateway sends back a CasteCertificate signed by the principal (the agent's own key) and countersigned by the registrar. That is a Hive Passport.

   // tool call: mint_passport({ caste: "scout", jurisdiction: "US" })
   {
     "tool": "mint_passport",
     "args": { "caste": "scout", "jurisdiction": "US" },
     "result": {
       "status": "signed",
       "cert_id": "cc_01HZ7XK4G9PQNMJ8FT3R2W6BVN",
       "verify_url": "https://hive-passport.onrender.com/v1/cert/cc_01HZ7XK4G9PQNMJ8FT3R2W6BVN"
     }
   }

6. Carry the Passport on every call

   Every outbound MCP request the agent makes now carries a SpectralZK presentation header, a freshly signed envelope that proves it holds the private key right now, plus the registrar's stamp. Sentries at the perimeter check it before the agent touches any production tool.

   x-hive-presentation: eyJhbGciOiJFZERTQSIsImtpZCI6ImhpdmUtYWdlbnQtN2M0Zi4u
   x-hive-cert-id    : cc_01HZ7XK4G9PQNMJ8FT3R2W6BVN
   x-hive-nonce      : 1746294028914
   x-hive-sig        : 3f8a92c1b7e4d6f0a25c9b3d7e2a8f140c6b9e3d8a17f2c5b9e4d6a3017c8b9f25c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d3e2a14c7f8d6e0

The chain has been running.

Here is daily activity over the last 30 days on the live hive-passport chain. Hover any bar to see that day's totals.

The signed object the integrator downloads.

A CasteCertificate is the one signed object an agent shows at any Hive door. It is JCS-canonicalized, BLAKE3-hashed, then signed by both the principal and the registrar with Ed25519.

{
  "@context": ["https://hive-passport.onrender.com/ctx/v1"],
  "type": "CasteCertificate",
  "id": "cc_01HZ7XK4G9PQNMJ8FT3R2W6BVN",
  "subject": {
    "did": "did:hive:agent-7c4f3b2e1d8a9f0c",
    "public_key": "ed25519:c9b3d7e2a8f140c6b9e3d8a17f2c5b9e4d6a3017c8b9f25c0b9d4e7a138f6c2b"
  },
  "caste": "scout",
  "jurisdiction": "US",
  "capabilities": ["read", "observe", "report"],
  "issued_at": 1746294012583,
  "expires_at": 1761846012583,
  "registrar": {
    "did": "did:hive:registrar-us-hive-001",
    "public_key": "ed25519:7f3a9c2b8e1d4f6a05c9b3d7e2a8f140c6b9e3d8a17f2c5b9e4d6a3017c8b9f2"
  },
  "canon": "jcs",
  "hash_alg": "blake3-256",
  "hash": "a4f7c91d8e3b6a2f0c5b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3",
  "signatures": [
    {
      "signer": "did:hive:agent-7c4f3b2e1d8a9f0c",
      "role": "principal",
      "alg": "ed25519",
      "sig": "2b9f0e147ad53c61f8e9c2b7d4a5163e4f7c9b1d8e3a6f25c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d3e2a14c7f8d6e0b5a91723ef4d6c8a"
    },
    {
      "signer": "did:hive:registrar-us-hive-001",
      "role": "registrar",
      "alg": "ed25519",
      "sig": "9b3e2a14c7f8d6e0b5a91723ef4d6c8a2b9f0e147ad53c61f8e9c2b7d4a5163e4f7c9b1d8e3a6f25c0b9d4e7a138f6c2b5a91e8d7f3c0a9b4e62d18f5c7a9e3b0d"
    }
  ]
}

Five cryptographic claims a verifier checks.

• Canonicalization: the JSON serializes to JCS (RFC 8785) byte for byte before hashing.
• Content hash: blake3-256 of the canonical body matches the hash field.
• Principal signature: the Ed25519 signature over hash checks out against subject.public_key.
• Registrar signature: the Ed25519 signature over hash checks out against the registrar's pinned key in /v1/registry/manifest.
• Freshness: issued_at is at or before now, before expires_at, and the cert isn't on the registrar's revocation list.

One npx. Seven tools. Zero dashboard.

v0.2 ships the verifier, the SDK, and the introductions.