Vorim AI is an open-protocol identity and audit layer for AI agents, providing cryptographic identities, scoped permissions, tamper-evident audit chains, and one-command revocation across frameworks like LangChain, CrewAI, and OpenAI SDK.
Built **Vorim AI** — an open-protocol identity and audit layer for AI agents. Posting here because this community is the one where the feedback will actually be useful. **The problem I started with:** If you're running agents in production whatever framework, whatever model you eventually hit four questions you can't answer: 1. Which specific agent did this action? 2. Was it authorised to do it? 3. Can you prove what happened in a way that holds up in an audit? 4. If something goes wrong, can you revoke that agent's authority everywhere in one command? Most production agent stacks today answer all four with "uh, kind of, if you grep the logs." That's the gap. **What Vorim AI does (in one line per primitive):** * Every agent gets its own cryptographic identity (Ed25519 keypair, not a shared API key) * Permissions are scoped and time-bound by default — they expire, they don't accumulate * Every action is logged into a hash-linked, signed audit chain (tamper-evident, exportable) * Revocation is one API call, propagates to all systems the agent touches **What's actually shipping:** * vorim/sdk (TypeScript) and vorim (Python) on npm + PyPI * vorim/mcp-server — 17 tools for Claude Desktop, Cursor, any MCP-compatible client * Integrations for Claude, OpenClaw, LangChain, CrewAI, OpenAI SDK, Pydantic AI, Stripe ACP. * Free tier: 3 agents, 10K events/month, no card **Why I'm posting here:** Honest market check. I want to know if I'm solving a real problem or chasing something only I find interesting. Four questions, brutally honest answers welcome: 1. **For LangChain / CrewAI / OpenAI SDK users** — does the four-primitive framing (identity / scopes / audit / revoke) match the pain you actually have, or is it irrelevant? What's the *actual* hardest thing about running your agents in prod? 2. **For people running multiple agents in CI/staging** — is the free tier (3 agents, 10K events) usable, or does it cap before you can validate the integration? 3. **What would push you from "interesting" to "I'd actually wire this in"?** SSO? Self-hosting? Better docs? An out-of-the-box LangSmith bridge? 4. **What screams "overengineered" to you?** I'd rather hear "you're solving a problem that doesn't exist" today than burn six months building the wrong thing. **Context worth knowing:** Machine and AI identities now outnumber human identities **109:1** in modern enterprises (Palo Alto Networks, May 2026). The 99% of identities flowing through your environment are non-human, and almost none of them have proper identity controls. **If you install it and something breaks**, DM me .
A developer built an SDK that adds identity, permissions, and audit capabilities to AI agent frameworks like LangChain and CrewAI, seeking feedback on its approach.
The article addresses the critical gap in control mechanisms for AI agents, introducing VION Protocol as a runtime layer for enforcing identity, permissions, validation, audit, and halting capabilities to ensure safe deployment.
AgentAudit is an open, extensible framework for evaluating the full lifecycle of AI agents across capability, grounding, security, and behavioral dimensions, enabling precise failure attribution and highlighting trustworthiness differences among various language models.
OxDeAI is an open-source protocol for deterministic pre-execution authorization of AI agent actions, providing signed artifacts and guards to enforce policy outside the agent loop. It supports popular agent frameworks like LangGraph, CrewAI, and AutoGen, and is seeking critical feedback.
Cinchor is an open-source tool that provides an accountability layer for AI agents, allowing developers to bound agent capabilities before actions and prove actions after via hashed, signed, append-only records. It includes SDKs for TypeScript, Python, and Go and runs without tokens, wallets, or gas.