@bindagt/openai

@bindagt/openai

AGT-9303 identity for OpenAI Agents SDK agents: prove which domain your agent belongs to, and check the same for anyone calling you.

npm install @bindagt/openai @openai/agents

Present your identity on an outbound call

import { presentAs } from "@bindagt/openai";

const { fetch } = await presentAs("agt://mydomain.com/my-agent");
await fetch("https://partner.example.com/agent", { method: "POST", body: "..." });

fetch is a drop-in replacement for the global fetch — every request made through it carries your AGT-Identity header.

Verify who's calling you

import { Agent, run } from "@openai/agents";
import { verifyIdentityGuardrail } from "@bindagt/openai";

const agent = new Agent({
  name: "Support Bot",
  instructions: "...",
  inputGuardrails: [verifyIdentityGuardrail()],
});

// In your own HTTP handler — the SDK never sees the raw request, so this
// one line of wiring is on you:
const result = await run(agent, req.body.input, {
  context: { agtIdentityHeader: req.headers["agt-identity"] },
});

Verification is always live against BindAgt's registry — a cached or stale header can't fool a receiver, because the current registry state is what's actually checked, not the document's own claims.

What this doesn't do

• No rotation or storage. presentAs() fetches a fresh document every call. Cache it yourself if you need to avoid the round trip.
• No automatic header wiring on the consumer side. The OpenAI Agents SDK has no hook into raw HTTP requests — only into the context object you pass to run(). You extract the header from your own server framework and put it there.
• No ephemeral agent support. Deferred to a future version of both AGT-9303_Standard.md and this plugin.
• No proof-of-possession. An AGT-9303 v1.4 document is a bearer credential — anyone who obtains a valid document (e.g. by intercepting a request) can replay it. Verification confirms the agent named in the document is real and in good standing; it does not confirm the caller presenting it is that agent. The standard's roadmap (AGT-9303_Standard.md §13) adds an emitter signature over the document in v1.5 (EIP-712), but signature verification and possession-binding are separate problems — until both exist, treat this the same way you'd treat any bearer token: over TLS only, and paired with your own transport-level trust (mTLS, network allowlists, etc.) for anything higher-stakes than identification.

Errors

Every failure is a BindAgtError with a stable code (AGENT_NOT_FOUND, NETWORK_ERROR, INVALID_AGENT_ID, …) re-exported from the bindagt SDK — never a generic thrown error.