scorelayerprotocol/slp

ScoreLayer Protocol, or SLP, is a proposed open specification rather than a piece of software you install. It addresses a problem that comes up as AI agents increasingly call APIs, make payments, or access systems outside the organization that built them: the system on the receiving end usually has no standard way to know who that agent really is, how it has behaved in the past, or what model is actually generating its requests right now. The spec points out that a valid API key or OAuth token only proves someone has a working credential, not whether that agent has a track record of staying within its intended scope or has been flagged elsewhere for unusual behavior. SLP proposes three pieces to fill that gap: an Agent Passport, a signed identity document tied to the agent that survives model changes and redeployments, a Behavioral Trust Score built from verified interactions the agent has had across different organizations, and an Inference Stack Attestation, a signed statement of which model or runtime is generating a given call. A verification API is also described, meant to let a gateway, payment processor, or infrastructure provider check an inbound agent in real time. SLP is designed to sit alongside existing OAuth or API key systems rather than replace them. The project also addresses some practical concerns directly, such as letting an agent dispute being flagged as anomalous instead of being silently penalized, and tying reputation to the organization that issued it so a bad actor cannot simply re-register under a new name to erase a poor history. This is currently a draft RFC, version 0.1, explicitly open for outside contributors to propose changes or co-author sections through GitHub issues and pull requests. It is one of several competing efforts trying to define trust standards for AI agents, and the authors are upfront that today's reference implementation is run by a single company, with a federated version planned. The project is released under the MIT license.