UCAN-based capability tokens for haex space authorization

RVM (Agentic Virtual Machine) host adapter for agent-harness-generator — hardware-isolated deployment via capability tokens

Pass-by-reference data binding for kohaku: query:// reference resolution, capability tokens and staleness detection.

Ed25519-signed capability tokens for Orqenix local-first mesh (CR v7.1 Ch.14)

Capability-scoped secret injection for Telegram Serverless bots — store vendor secrets encrypted, grant narrow capability tokens, inject on egress

Model Context Protocol (MCP) server for verifiable credentials, cryptographic delegation proofs, and scoped capability tokens for AI agents.

Zero-trust crypto core for Combs Engine — identity, sealed envelopes, at-rest keystore, capability tokens. Pure WebCrypto; browser, Node and Deno.

Pingerchips server SDK for Node.js - trigger events and issue capability tokens

Ed25519-signed, hash-chained execution traces and capability tokens for AI agents — prove what an agent was allowed to do and what it actually did.

Authorization for AI agents: verifiable, scoped, revocable capability tokens (mandates) with attenuable delegation, for MCP and A2A. The reference implementation of agent authority — zero-dependency TypeScript & Python.

JWT / OIDC identity resolution for kohaku hosts (principal, roles, tenant from claims) with capability tokens delegated to @kohaku-ui/authz-hmac — a reference adapter; the contract stays @kohaku-ui/spec-core's ports.ts.

RVM (Agentic Virtual Machine) host adapter for zagents-generator — hardware-isolated deployment via capability tokens

Command-line interface for ABSuite — issue capability tokens, record and verify execution traces, and run the local stack.

HMAC-SHA256 capability tokens for kohaku's AuthzPort: an on-behalf-of token whose payload is transparent (base64url(payload).base64url(hmac)), suitable as the default issuer for a single host and as the capability signer behind a JWT/OIDC principal resolv

Arsenal agent-side SDK: Agent Capability Tokens (ACT), scoped credential proxy, broker client, policy engine.

Fail-closed client for the Archytan Lite authorization gate. Verifies the gate's Ed25519 signature and that the receipt matches the request, and redeems single-use capability tokens before acting; treats every other outcome as denied.

Credential core: agent identity, verifiable credentials, capability tokens, enforcement, audit — local-first.

L0 — the public contract of Build0 Runtime. Types, capability tokens, event contracts, and a pure schema validator. No third-party dependencies and no ambient access, ever.

Ability-first Service Plane primitives for schema-backed Cap'n Web RPC, STS capability tokens, OpenAPI, and MCP projections.

OIDC/OAuth2 bridge for OpenAgent SDK — maps between human OIDC tokens and OAS agent DIDs + Arsenal capability tokens.