A registry and transparency log for discovering and verifying AI agents by name.
DNS resolves a domain to an address. ANS resolves an agent name to a verifiable, versioned identity — backed by certificates and an append-only transparency log.
Reference implementation · Go SDK
As autonomous agents begin calling each other across organizations, two questions have no good answer today:
- Who is this agent, really? Anyone can claim to be
support-agent.acme.com. There's no standard way to prove it. - How do I find the right one? No registry maps a name + capability + version to a trustworthy endpoint.
ANS answers both. Every agent gets a versioned, DNS-style name like
ans://v1.0.0.my-agent.example.com, an identity certificate issued only after DNS/ACME domain
validation, and a public transparency-log record — so any party can independently verify an
agent's identity, capabilities, and history without trusting a middleman.
| Piece | Role |
|---|---|
| Registry Authority | Registers agents, validates domain ownership (DNS + ACME), issues identity & server certificates, and exposes search / resolution. |
| Transparency Log | A durable, append-only Merkle-tree log of every agent event, with COSE / SCITT receipts (RFC 9162, RFC 6962) proving an agent's state at a point in time. |
| Identity certificates | Private-CA-signed certs enabling mutual TLS and badge-verified agent-to-agent calls. |
| Offline verifier | ans-verify — cryptographically validates an agent's record and proofs with no live service dependency. |
Think of it as DNS + Certificate Transparency, built for agents.
