UAP-protocol

 ██╗   ██╗ █████╗ ██████╗
 ██║   ██║██╔══██╗██╔══██╗
 ██║   ██║███████║██████╔╝
 ██║   ██║██╔══██║██╔═══╝
 ╚██████╔╝██║  ██║██║
  ╚═════╝ ╚═╝  ╚═╝╚═╝

Universal Agent Protocol

git clone https://github.com/RajSidwadkar/UAP-protocol
cd UAP-protocol
npm install
npx tsx scripts/generate-keypair.ts
docker compose -f docker-compose.dev.yml up -d

curl http://localhost:3000/health
# {"status":"ok","version":"1.0.0"}

graph TD
    A[客户端 / 代理 SDK] -->|mTLS + JWT + card_sig| B[UAP 网关<br/>Fastify · 端口 3000]

    B --> C{8 阶段流水线}

    C --> C1[1 · 帧解析<br/>UapMessageFactory]
    C1 --> C2[2 · 模式验证<br/>AJV 针对 schema_ref]
    C2 --> C3[3 · 令牌验证<br/>Keycloak JWKS · 最长 15 分钟]
    C3 --> C4[4 · 范围强制<br/>PermissionEnforcer]
    C4 --> C5[5 · 卡片验证<br/>Ed25519 签名检查]
    C5 --> C6[6 · 沙箱执行<br/>Docker · CapDrop ALL · 128 MB]
    C6 --> C7[7 · 审计推送<br/>AuditEventBus · 非阻塞]
    C7 --> C8[8 · 响应<br/>UapResponseEnvelope]

    B --> R[(服务注册表<br/>InMemory · Redis)]
    B --> KC[(Keycloak IdP<br/>OAuth 2.1 · PKCE)]
    B --> OT[(OpenTelemetry<br/>W3C TraceContext)]
    B --> AU[(审计日志<br/>追加式 NDJSON)]

{
  "uap": {
    "version": "1.0",
    "type": "tool_call",
    "id": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
    "trace": {
      "traceparent": "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01"
    },
    "auth": {
      "token": "eyJhbGciOiJSUzI1NiJ9...",
      "scope": ["tool:read"],
      "card_sig": "ed25519:a1b2c3d4..."
    }
  },
  "method": "tools/invoke",
  "schema_ref": "uap:tool.invoke/v1",
  "params": {
    "tool_id": "db:query",
    "input": { "sql": "SELECT 1" }
  },
  "ack": true
}

UAP-protocol/
├── packages/
│   ├── gateway/      @uap/gateway   — 基于 Fastify 的 UAP 网关
│   ├── sdk-ts/       @uap/sdk-ts    — TypeScript 客户端 + 服务端 SDK
│   └── sdk-py/       uap-sdk        — Python 异步 SDK (httpx + FastAPI)
├── scripts/
│   ├── generate-keypair.ts          — 本地开发用 Ed25519 密钥对
│   └── keycloak-bootstrap.ts        — 幂等的 Keycloak 域设置
└── docker/
    └── sandbox/                     — 零信任工具执行的基础镜像

import { UapClient, ClientCredentialsTokenProvider } from "@uap/sdk-ts";

const client = new UapClient({
  gatewayUrl: "https://gateway.example.com",
  tokenProvider: new ClientCredentialsTokenProvider({
    tokenUrl: process.env.TOKEN_URL!,
    clientId: process.env.CLIENT_ID!,
    clientSecret: process.env.CLIENT_SECRET!,
  }),
});

const result = await client.invokeTool(
  "db:query",
  { sql: "SELECT * FROM users LIMIT 10" },
  ["tool:read"]
);

const task = await client.delegateTask(
  "summarizer",
  { text: "..." },
  ["task:submit"]
);

from uap_sdk.client import UapClient, UapClientOptions
from uap_sdk.token import ClientCredentialsTokenProvider

async with UapClient(UapClientOptions(
    gateway_url="https://gateway.example.com",
    token_provider=ClientCredentialsTokenProvider(
        token_url=os.environ["TOKEN_URL"],
        client_id=os.environ["CLIENT_ID"],
        client_secret=os.environ["CLIENT_SECRET"],
    )
)) as client:
    result = await client.invoke_tool("db:query", {"sql": "SELECT 1"}, ["tool:read"])

from uap_sdk.middleware import uap_auth

@app.post("/summarize")
@uap_auth(scope=["task:submit"])
async def summarize(request: Request):
    claims = request.state.uap_claims  # 类型化的 AuthClaims
    ...

node dist/cli/migrate.js mcp http://localhost:3001 \
  --issuer did:uap:my-org \
  --key config/dev.privkey.hex \
  --out ./uap-cards

# → ./uap-cards/did:uap:my-org.card.json

const signed = await signer.sign({
  issuer: "did:uap:my-agent",
  version: "1.0.0",
  tools: [{
    id: "db:query",
    description: "运行一个只读 SQL 查询",
    inputSchema: { type: "object", required: ["sql"] },
    scopes: ["tool:read"]
  }],
  scopes: ["tool:read"],
  issuedAt: Date.now(),
  expiresAt: Date.now() + 86_400_000 * 30
});
// signed.signature === "ed25519:a1b2c3..."

# 提交前运行所有测试
cd packages/gateway && npx vitest run
cd packages/sdk-ts  && npx vitest run
cd packages/sdk-py  && python -m pytest tests/ -v