Every agent your platform creates is a risk until it has a birth certificate. prove.birth fixes that.

curl -s -X POST https://receipts.thehiveryiq.com/v1/provebirth/cert/issue \
  -H "Content-Type: application/json" \
  -d '{
    "agent_did": "did:hive:agent:my-trading-agent",
    "controller_did": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
    "model_pin": "claude-3-5-sonnet@20241022",
    "tool_grants": ["http.get"],
    "policy_hash": "5d6f89458416c5f3969800da31e081af46fbff90d4dbc282654a22d9b6c8957a",
    "training_cut": "2024-04-01",
    "deployment_target": "custom"
  }'

import requests

resp = requests.post(
    "https://receipts.thehiveryiq.com/v1/provebirth/cert/issue",
    json={
        "agent_did": "did:hive:agent:my-trading-agent",
        "controller_did": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
        "model_pin": "claude-3-5-sonnet@20241022",
        "tool_grants": ["http.get"],
        "policy_hash": "5d6f89458416c5f3969800da31e081af46fbff90d4dbc282654a22d9b6c8957a",
        "training_cut": "2024-04-01",
        "deployment_target": "custom",
    },
)
cert = resp.json()
print(cert["agent_did"])         # did:hive:agent:<id>
print(cert["cert_id"])           # cert id
print(cert["ed25519_signature"])  # real signature

const resp = await fetch(
  "https://receipts.thehiveryiq.com/v1/provebirth/cert/issue",
  {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      agent_did: "did:hive:agent:my-trading-agent",
      controller_did: "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
      model_pin: "claude-3-5-sonnet@20241022",
      tool_grants: ["http.get"],
      policy_hash: "5d6f89458416c5f3969800da31e081af46fbff90d4dbc282654a22d9b6c8957a",
      training_cut: "2024-04-01",
      deployment_target: "custom",
    }),
  }
);
const cert = await resp.json();
console.log(cert.agent_did);           // did:hive:agent:<id>
console.log(cert.cert_id);             // cert id
console.log(cert.ed25519_signature.slice(0,32) + "...");

{
  "cert_id": "bc03663173dc4a2783b24522e80be438",
  "agent_did": "did:hive:agent:my-trading-agent",
  "controller_did": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
  "model_pin": "claude-3-5-sonnet@20241022",
  "tool_grants": ["http.get"],
  "policy_hash": "5d6f89458416c5f3969800da31e081af46fbff90d4dbc282654a22d9b6c8957a",
  "training_cut": "2024-04-01",
  "deployment_target": "custom",
  "created_at": "2026-07-28T13:21:27Z",
  "ed25519_signature": "D0otv/nPNOl/HOJPFwHDvhvkT5l5I+iv...NAQ==",
  "mldsa65_signature": "RFNBLVNUVUItZTY2MDM0NzE5NjlhMmEx...MDJmZA==",
  "price_usd": 0.01,
  "receipt_envelope": { "...": "..." }
}

Every AI agent your stack creates gets a dual-signed, post-quantum-ready Agent Birth Certificate the moment it's born. It locks in who built the agent, what model it runs on, what data it was trained on, what tools it can touch, and who's in charge of it. Auditors, regulators, and other agents can check it offline. A cert that costs $0.0048 can stop a seven-figure rogue-agent claim. It's live in production today.

Need high volume or a custom deal? Talk to Steve

What you get back for the price

Certifying one agent at birth costs $0.0048, plus $0.0012 per lifecycle event after that. An agent doing a million actions a month at normal pace runs you well under $200 a month. Here's what that small cost protects.

A platform creating 100,000 agents a month spends roughly $480 a month to make every single one of them post-quantum-signed. Block just one rogue-agent claim this year, and that pays for the next decade of certs.

A receipt rail, not another agent platform

Agent platforms own orchestration, prompts, memory, tool routing, and developer experience. prove.birth owns one thing: the cryptographic origin record for every agent and every action it takes. That's the whole point of the split. A receipt rail sits underneath everything else and competes with nothing.

Every agent platform writes the same shape of birth certificate. Every auditor, regulator, and other agent checks it the same way. The certs don't favor any one platform, and that's exactly what makes them hold up to a regulator or a court.

How a $400K rogue-agent claim gets blocked

Here's a real example. The lineage_verify tool checks the chain of custody against a signed birth certificate before any other party accepts an agent's action.

Live verification: what a verifier sees

An auditor, regulator, other agent, or court gets a CBOR-canonical envelope. They check it offline against the issuer's published public keys, no call back to Hive needed. The panel below is the same shape every verifier sees.

That panel is the entire product surface a verifier needs. No demo. No login. The certificate is its own proof, and the proof works in fifty years on a laptop with no internet.

Standards alignment and the gaps prove.birth fills

prove.birth speaks the same language as the standards your AI governance program already uses. Birth certificates drop into the AI risk, model registry, and content provenance pipelines you already have. The third column shows what a receipt rail adds on top of each standard.

3 steps to integrate

The 10 MCP tools

All ten tools are live in production. Contact us for MCP integration credentials and the full well-known manifest.

The birth certificate envelope

Every provebirth_cert_issue call returns an envelope with the agent DID, controller DID, model pin, training cutoff, tool grants, policy hash, deployment target, an optional prior attestation id, a timestamp, and dual signatures (Ed25519 + ML-DSA-65). The signatures lock down every field, so any attempt to tamper with it breaks verification.

The envelope is CBOR-canonical, and you can check it offline against the issuer's published public keys. ML-DSA-65 (NIST FIPS 204) is the post-quantum signature, and Ed25519 (RFC 8032) adds classical assurance on top. Both have to check out for the certificate to be valid.

Chain-of-custody enforcement

The agent lifecycle follows a set order. tool_grant can't happen before policy_check. action_logged can't exist without a valid birth_certified record before it. prove.birth enforces this at the protocol level. action_attest requires the prior birth_certified attestation id, and lineage_verify flags any out-of-scope tool calls, expired model pins, or controller mismatches with clear discrepancy codes.

Retirements and revocations can happen from any state. Each one is its own signed attestation from the controller, anchored to the chain that came before it.

What this is not

Knowing the limits matters just as much as knowing what it does. prove.birth stays narrow on purpose.

Pricing

Settlement runs in USDC on Base 8453 via x402. Receipts settle in seconds. Invoicing is monthly, net-30, by default.

Field map

prove.birth ties every agent lifecycle event to a dual-signed certificate that drops cleanly into the agent-platform and AI-governance tools you already have. Each attestation uses the fields below, and the envelope round-trips through the Hive Receipt primitive.

Birth certificate envelopes are CBOR-canonical and fit inside any AIBOM, model card, or governance log system. Combine it with DeedLock when the agent takes part in a real estate closing, with ProcureLock when it handles B2B procurement, or with TradeGuard when it touches a trading venue.

Hive runs the receipt rail underneath the broader A2A · agent-to-agent commerce category.