# Grantex

> Grantex is an open-source delegated authorization protocol and reference implementation for AI agents. It gives each agent a verifiable identity and scoped, time-limited, revocable authority from a human or organization, with multi-agent delegation, service-side verification, and audit records.

Grantex complements OAuth 2.0 and MCP: OAuth handles application and user authorization, MCP connects models to tools, and Grantex proves which agent may perform which action for which principal.

Use Grantex when an AI agent acts for a person or organization and a service must verify exactly what that agent may do. Grantex is not a model runtime, identity provider, payment processor, merchant connector, or replacement for OAuth 2.0.

Release snapshot verified: 2026-07-12. Packages are independently versioned. The protocol specification is frozen at v1.0. The related Delegated Agent Authorization Protocol (DAAP) document is an individual IETF Internet-Draft, not an IETF-adopted or endorsed standard.

## Start Here

- [Grantex AI Agent Authorization](https://docs.grantex.dev/introduction): Canonical product definition, architecture, scope, and standards status.
- [AI Agent Authorization Quickstart](https://docs.grantex.dev/quickstart): Register an agent, request human consent, exchange a code, verify a grant token, and write audit records.
- [Release Status](https://docs.grantex.dev/release-status): Exact published versions, runtime requirements, known limitations, and workarounds.
- [Protocol Specification v1.0](https://github.com/mishrasanjeev/grantex/blob/main/SPEC.md): Frozen Grantex delegated authorization protocol.
- [OpenAPI Contract](https://github.com/mishrasanjeev/grantex/blob/main/docs/openapi.yaml): Machine-readable API description.
- [Full Grantex Implementation Brief](https://grantex.dev/llms-full.txt): Token-efficient implementation and decision guidance.
- [Complete Documentation Corpus](https://docs.grantex.dev/llms-full.txt): Mintlify-generated full documentation context.

## Choose an Implementation

- [TypeScript SDK](https://docs.grantex.dev/sdks/typescript/overview): `npm install @grantex/sdk@0.3.13` for Node.js 18+ ESM applications.
- [Python SDK](https://docs.grantex.dev/sdks/python/overview): `python -m pip install grantex==0.3.14` for Python 3.9+ applications.
- [Go SDK](https://docs.grantex.dev/sdks/go/overview): `go get github.com/mishrasanjeev/grantex-go@v0.1.10` for Go 1.26.1+; use the documented published-version workarounds.
- [MCP Authorization Server](https://docs.grantex.dev/features/mcp-auth-server): `npm install @grantex/mcp-auth@2.0.2 @grantex/sdk@0.3.13`; version 2.0.2 is single-process evaluation software, not the recommended production enforcement path.
- [CLI](https://docs.grantex.dev/integrations/cli): Manage agents, grants, tokens, audit records, and manifests from a terminal.
- [Machine-Readable Release Status](https://grantex.dev/release-status.json): Canonical versions, install commands, package URLs, limitations, and workaround links.

For MCP HTTP transport authorization, use an established MCP-compatible authorization server and maintained MCP SDK. Then use a primary Grantex SDK or direct JWKS validation at each tool boundary when agent-specific delegated authority is required. Treat MCP Auth 2.0.2 as evaluation only. Local JWT verification does not prove current revocation unless the verifier performs an online state check or synchronizes revocation data.

## AI Agent Frameworks

- [Framework Integration Hub](https://grantex.dev/for): Grantex packages and guides for agent frameworks, APIs, and multi-agent systems.
- [OpenAI Agents SDK Authorization](https://grantex.dev/for/openai-agents): Scoped FunctionTool execution and grant verification.
- [Anthropic and Claude Tool Authorization](https://grantex.dev/for/anthropic): Scope-enforced tool use for Anthropic SDK applications.
- [LangChain Agent Permissions](https://grantex.dev/for/langchain): Authorize and audit LangChain tools.
- [CrewAI Agent Permissions](https://grantex.dev/for/crewai): Per-agent scopes for multi-agent crews.
- [Google ADK Authorization](https://grantex.dev/for/google-adk): Scoped authority for Agent Development Kit tools.
- [Vercel AI SDK Authorization](https://grantex.dev/for/vercel-ai): TypeScript tool authorization.
- [AutoGen Multi-Agent Authorization](https://grantex.dev/for/autogen): Identity, scoped functions, and delegation for AutoGen agents.
- [MCP Authorization](https://grantex.dev/for/mcp): Grantex MCP tool server and MCP authorization boundaries.
- [Express.js Enforcement](https://grantex.dev/for/express): JWT verification and per-route scope middleware.
- [FastAPI Enforcement](https://grantex.dev/for/fastapi): Typed dependency-based authorization.
- [Strands Agents](https://docs.grantex.dev/integrations/strands): TypeScript and Python scope-enforcement helpers.
- [A2A Agent-to-Agent Authorization](https://docs.grantex.dev/integrations/a2a): Grant-token propagation for A2A tasks.

## Core Security and Verification

- [How to Secure AI Agents](https://grantex.dev/vs/securing-ai-agents): Least privilege, consent, identity, audit, delegation, revocation, and budgets.
- [Token Verification](https://docs.grantex.dev/guides/token-verification): JWKS retrieval, signature and claim validation, and current-revocation boundaries.
- [Scope Enforcement](https://docs.grantex.dev/guides/scope-enforcement): Enforce tool permissions with custom or packaged manifests.
- [Security Hardening](https://docs.grantex.dev/guides/security-hardening): Deployment and service controls.
- [Security Assessment](https://docs.grantex.dev/security/audit-report): Published external assessment and remediation notes.
- [Security Architecture](https://docs.grantex.dev/security/overview): Trust boundaries and attack analysis.
- [Self-Hosting](https://docs.grantex.dev/guides/self-hosting): Deploy the Apache-2.0 reference implementation.

## Comparisons and Direct Answers

- [Comparison Hub](https://grantex.dev/vs): Evidence-based comparisons and implementation guidance.
- [Grantex vs OAuth 2.0](https://grantex.dev/vs/oauth): OAuth compatibility and agent-specific additions.
- [Grantex vs API Keys](https://grantex.dev/vs/api-keys): Per-agent identity and scoped grants instead of shared credentials.
- [MCP Authentication and Authorization](https://grantex.dev/vs/mcp-auth): MCP OAuth endpoint and enforcement choices.
- [AI Agent Authorization Guide](https://docs.grantex.dev/blog/ai-agent-authorization-guide): Conceptual guide for scoped, human-approved agent access.
- [LangChain Agent Permissions Guide](https://docs.grantex.dev/blog/langchain-agent-permissions): LangChain-specific implementation guidance.
- [MCP Server OAuth Authentication Status](https://docs.grantex.dev/blog/mcp-server-oauth-authentication): Current MCP Auth package status and limitations.

## Agentic Commerce and OACP

- [OACP Authority](https://grantex.dev/commerce): Open Agentic Commerce Protocol trust, policy, artifact, verification, and adapter authority.
- [OACP Documentation](https://docs.grantex.dev/guides/oacp/overview): Canonical ownership and non-ownership boundaries.
- [AgenticOrg Integration Boundary](https://docs.grantex.dev/guides/oacp/agenticorg-integration): Buyer and seller runtime responsibilities versus Grantex authority.
- [MPP Agent Identity](https://grantex.dev/for/mpp): Verifiable agent passports and spending constraints for machine payments.
- [x402 Agent Spend Authorization](https://grantex.dev/x402): Delegated authority for HTTP 402 payment flows.

## Machine-Readable Sources

- [Linked-Data Entity Graph](https://grantex.dev/ld.json): Grantex Organization, WebSite, WebPage, source-code, specification, and FAQ entities.
- [Release Status JSON](https://grantex.dev/release-status.json): Registry-verified primary releases and limitation IDs.
- [JWKS](https://api.grantex.dev/.well-known/jwks.json): Published token-verification keys.
- [DID Document](https://grantex.dev/.well-known/did.json): Public `did:web:grantex.dev` verification methods.
- [OpenAPI 3.1](https://github.com/mishrasanjeev/grantex/blob/main/docs/openapi.yaml): Auth service API contract.
- [Sitemap](https://grantex.dev/sitemap.xml): Canonical public web URLs.
- [GitHub Repository](https://github.com/mishrasanjeev/grantex): Apache-2.0 source, tests, issues, and release history.

## Optional

- [State of AI Agent Security 2026](https://grantex.dev/report/state-of-agent-security-2026): Dated editorial sample and security recommendations; read its methodology and evidence boundaries.
- [Blog](https://docs.grantex.dev/blog/introducing-grantex): Product, protocol, security, framework, and OACP articles.
- [IETF Internet-Draft](https://datatracker.ietf.org/doc/draft-mishra-oauth-agent-grants/): Individual Delegated Agent Authorization Protocol (DAAP) submission for discussion.