ID Wispera

The Identity Whisperer for AI Agents - A credential governance platform that uses a passport/visa metaphor to manage, secure, and audit AI agent credentials across platforms.

Why ID Wispera?

As AI agents proliferate across enterprises, credential management becomes a critical security challenge:

• Scattered Credentials: API keys, tokens, and secrets are spread across .env files, config files, and code
• No Visibility: Who has access to what? When was a credential last used? Who delegated it?
• Compliance Gaps: Audit trails are non-existent or incomplete
• Agent-to-Agent Delegation: As agents call other agents, tracking credential provenance is nearly impossible

ID Wispera brings order to this chaos with a passport/visa model:

• Passports represent credentials with full identity and lifecycle management
• Visas define what operations a credential is authorized to perform
• Delegation Chains track how credentials flow between agents and humans
• Audit Trails provide complete visibility into credential usage

Features

• Encrypted Vault: AES-256-GCM encrypted local storage with Argon2id key derivation
• Credential Detection: Automatically detect 30+ exposed API key, token, and secret patterns with risk classification
• Policy Engine: Cedar-inspired declarative rules engine for credential governance
• Audit Trail: Complete action logging with anomaly detection
• Delegation Management: Agent-to-agent credential delegation with scope narrowing and chain traversal
• Secure Sharing: Zero-knowledge credential sharing (AES-256-GCM) with expiry and view limits
• Locations Registry: Auto-detect credentials across 6 providers (OpenClaw, AWS, SSH, Docker, npm, Kubernetes)
• Credential Provisioning: Programmatic key creation across 8 providers (OpenAI, AWS, Google Cloud, Azure Entra, GitHub, Twilio, SendGrid, Anthropic)
• Framework Integrations: LangChain, OpenAI Agents SDK, Google A2A, Slack, and CrewAI support across TypeScript, Python, and Go
• Enhanced Import: Scan directories and import by confidence level
• MCP Integration: Native Model Context Protocol server for AI agent credential management
• Browser Extension: Detect and secure credentials directly in your browser
• CLI Tools: Full command-line interface for credential management

Modules

Module	Description
Vault	AES-256-GCM encrypted credential storage
Passport	CRUD, status tracking, expiry management
Detection	30+ credential patterns, risk classification
Policy	Cedar-inspired declarative rules engine
Audit	Complete action logging with anomaly detection
Delegation	Agent-to-agent credential delegation with scope narrowing
Sharing	Zero-knowledge credential sharing with expiry controls
Locations	Auto-detect credentials across 6 system providers
Provisioning	Programmatic key creation across 8 providers (OpenAI, AWS, Google Cloud, Azure Entra, GitHub, Twilio, SendGrid, Anthropic)
Integrations	LangChain, OpenAI Agents SDK, Google A2A, Slack, CrewAI -- governed credential access for AI agent frameworks

Installation

Choose the SDK that best fits your workflow:

TypeScript / Node.js

Best for: MCP servers, web applications, Claude Desktop integrations

# Clone and build
git clone https://github.com/gecochief/id.wispera.git
cd id.wispera
npm install && npm run build

# Link CLI globally
cd packages/cli && npm link
idw --help

Python

Best for: LangChain, CrewAI, ML pipelines, Jupyter notebooks

pip install id-wispera

# With framework integrations
pip install id-wispera[langchain]  # LangChain support
pip install id-wispera[crewai]     # CrewAI support
pip install id-wispera[all]        # All integrations

# CLI
idw-py --help

Go (Single Binary)

Best for: CI/CD pipelines, DevOps, cross-platform distribution

# macOS
brew install id-wispera

# Or download binary for your platform:
# - idw-darwin-amd64 (macOS Intel)
# - idw-darwin-arm64 (macOS Apple Silicon)
# - idw-linux-amd64 (Linux x64)
# - idw-windows-amd64.exe (Windows)

idw --help

SDK Comparison

Feature	TypeScript	Python	Go
Core Types	Y	Y	Y
Encrypted Vault (AES-256-GCM)	Y	Y	Y
Passport CRUD	Y	Y	Y
Detection (30+ patterns)	Y	Y	Y
Audit Trail	Y	Y	Y
Policy Engine	Y	Y	Y
Delegation Management	Y	Y	Y
Secure Sharing	Y	Y	Y
Locations Registry	Y	Y	Y
Credential Provisioning	Y	Y	Y
CLI	Y	Y	Y (primary)
MCP Server	Y	-	-
Browser Extension	Y	-	-
LangChain Integration	Y	Y	-
CrewAI Integration	-	Y	-
OpenAI Agents SDK	Y	Y	Y
Google A2A Protocol	Y	Y	Y
Slack Integration	Y	Y	Y

Quick Start

Install

TypeScript

npm install -g @id-wispera/cli

Python

pip install id-wispera

Go

brew install id-wispera

Workflow

# Initialize your encrypted vault
idw init

# Scan a project for exposed credentials
idw scan ./my-project

# Import all detected credentials into your vault
idw import ./my-project --all --owner dev@company.com -y

# List all passports
idw list

# Show details for a specific passport
idw show <passport-id>

Import Examples

# Scan a project and import all detected credentials
idw import ./my-project --all --owner dev@company.com -y

# Import only high-confidence detections
idw import ./my-project --min-confidence 0.9 --owner dev@company.com

# Import from a specific .env file
idw import .env

Authenticate

# Log in (interactive — passphrase is cached in OS keychain)
idw auth login

# Check auth status
idw auth status

# For CI/headless: create a scoped session token
idw auth token create --name "ci-deploy" --scope read,list --ttl 24h
# Then set IDW_SESSION_TOKEN in your environment

Create a Passport Manually

# Interactive passport creation
idw create

# Or non-interactive (pipe credential via stdin)
echo "sk-..." | idw create --name "OpenAI Production" --type api-key --stdin --platform openai

Scan for Exposed Credentials

# Scan current directory
idw scan

# Scan specific path
idw scan ./config

# Output:
# Warning: Found 3 exposed credentials:
#   - .env:3 - OpenAI API Key (sk-...)
#   - config.json:15 - AWS Access Key (AKIA...)
#   - src/api.ts:42 - GitHub Token (ghp_...)

Testing

# Run all tests across the monorepo (via Turborepo)
npm test

# Run tests for a specific package
npm test --workspace=@id-wispera/core
npm test --workspace=@id-wispera/cli
npm test --workspace=@id-wispera/mcp-server

# Watch mode (re-runs on file changes)
npm test -- --watch

# Generate coverage reports
npm test -- --coverage

See CONTRIBUTING.md for the full testing guide.

Packages

TypeScript

Package	Description
@id-wispera/core	Core governance engine - types, vault, detection, policies, delegation, sharing, locations, provisioning
@id-wispera/cli	Command-line interface
@id-wispera/mcp-server	MCP server for AI agent integration
browser-extension	Chrome/Firefox extension

Python

Package	Description
id-wispera	Full SDK (9 modules) with CLI and LangChain/CrewAI integrations

Go

Package	Description
id-wispera	Full SDK (9 modules) with cross-platform binary CLI

The Passport/Visa Model

Passport

A passport is a governed credential with:

• Identity: Name, agent ID, credential type and value (encrypted)
• Authorization (Visa): What operations are permitted, on which platforms
• Lifecycle: Issued date, validity period, status (active/expired/revoked)
• Delegation: Chain of custody from human owner through any agent delegations
• Audit: Complete history of all actions taken with this credential

Six Visa Types

Type	Description	Example
access	Basic platform access	API key for read-only access
privilege	Elevated permissions	Admin token for write operations
data	Data access rights	Database credentials with table restrictions
compliance	Regulatory scope	HIPAA-compliant data access
ecosystem	Cross-platform	Multi-service integration tokens
custom	Business-defined	Custom authorization policies

MCP Integration

ID Wispera provides a native MCP server for seamless AI agent integration:

# Start the MCP server
npx @id-wispera/mcp-server

# Configure in your MCP client (e.g., Claude Desktop)

Available MCP tools:

• get_credential - Retrieve a credential by passport ID
• list_passports - List available passports
• request_access - Request access to a credential (creates audit entry)
• check_policy - Check if an action is permitted by policy

Browser Extension

The ID Wispera browser extension detects exposed credentials in web pages and offers to secure them:

• Real-time Detection: Scans pages for API keys, tokens, and secrets
• One-Click Capture: Create a passport directly from detected credentials
• Visual Indicators: Highlights potentially sensitive data
• Sync Support: Optional sync with your local vault

Install from Chrome Web Store | Install from Firefox Add-ons

Security

• Zero-Plaintext Architecture: Credentials are never exposed as plaintext in CLI arguments or logs. The vault is the single source of truth.
• Three Auth Modes: OS keychain (idw auth login), session tokens (IDW_SESSION_TOKEN) for CI/headless, or IDW_PASSPHRASE via environment variable / .env file for simple local dev.
• Local-First: All credentials stored locally, encrypted at rest
• Zero-Knowledge Sharing: Share credentials without exposing them to servers
• Audit Everything: Complete audit trail for compliance
• Policy Enforcement: Declarative policies prevent unauthorized access

See Security Architecture for details.

Examples

TypeScript

• MCP + Claude - Claude Desktop with credential governance
• .env Migration - Migrate from .env files

Python

• LangChain Integration - Governed LangChain agents
• CrewAI Integration - Multi-agent credential management

Cross-Platform

• OpenClaw Integration - Replace plaintext credentials

Documentation

• Getting Started
• Multi-SDK Plan - TypeScript, Python, Go SDK strategy
• Passport Model
• Visa Types
• MCP Integration
• Policy Engine
• Delegation Management
• Secure Sharing
• Locations Registry
• Credential Provisioning
• Framework Integrations
• Import & Detection
• Security
• Python SDK
• Go SDK

Contributing

We welcome contributions! Please see CONTRIBUTING.md for guidelines.

License

MIT - see LICENSE

---

ID Wispera - The Identity Whisperer for AI Agents