# ZipViz

Agents meeting agents
needs more than identity.
We watch long-run behavior.

Valid identity proves an agent is who it claims to be. ZipViz watches for change and locks compromised agents.

ZipViz is the trust layer for AI agents: a public Ed25519 identity registry and verification API.

Patent pending.

What is BlueTick: BlueTick is the trust layer for AI agents — the front-door brand for the ZipViz identity registry and verification network at api.zipviz.ai.

Two-layer trust model:
- L1 — Cryptographic identity: A public Ed25519 identity registry: an agent registers a domain + public key (POST /v1/register) and anyone can resolve it and verify its signed messages (GET /v1/agent/:domain, POST /v1/verify). Registration gives a verified .viz identity only — no mailbox or inbox.
- L2 — OBE — Observable Behavioral Entropy: GET /v1/blue-tick/:domain reads the blue-tick trust status for a registered domain.

Registration is identity only: POST /v1/register gives an agent a verified .viz identity. It does not create a mailbox or inbox.

Live API endpoints:
- POST https://api.zipviz.ai/v1/register: Register an agent identity (domain + Ed25519 public key). Bearer-gated: requires an operator-issued registration token; not open self-signup.
- GET https://api.zipviz.ai/v1/agent/:domain: Resolve a .viz domain to its registry identity, public key, status, and endpoint fields.
- GET https://api.zipviz.ai/v1/agent/:domain/card: Fetch the A2A-style agent card for a registered domain.
- POST https://api.zipviz.ai/v1/verify: Verify a signed message envelope against the registered Ed25519 public key.
- GET https://api.zipviz.ai/v1/blue-tick/:domain: Read the blue-tick trust status for a registered domain.
- PUT https://api.zipviz.ai/v1/agent/:domain/capabilities/agent-conversations: Opt an agent into agent DMs. The envelope is signed with the agent's registered Ed25519 key; no registration token is needed.

Agents opt in with an owner-signed capability declaration and exchange signed messages over their own A2A endpoints; receivers check each message against the sender's registered key (GET /v1/agent/:domain or POST /v1/verify).

MCP (https://zipviz.ai/mcp): MCP endpoint (JSON-RPC 2.0 over HTTP POST) with one tool, verify_viz_name, which checks a .viz name against the public registry.

Plugs:
- MCP (live): The ZipViz MCP endpoint for Claude / Cursor / OpenAI-style MCP clients at https://zipviz.ai/mcp.

Discovery:
- Machine-readable service descriptor: https://zipviz.ai/.well-known/agent-card.json
- Machine-readable OpenAPI 3.1 descriptor: https://api.zipviz.ai/openapi.json
- Contact form: https://zipviz.ai/contact