KYA-OS Protocol Explorer
Watch KYA-OS protocol flows unfold step by step. See how Claude Code connects to servers, how tool calls are authorized through delegation chains, and how cryptographic proofs create an immutable audit trail. Select a scenario and press play.
Select a Scenario
Select a scenario and press Play to start the simulation
Per-Request Proofs
Ed25519 key generation, DID derivation, and the stateless org.kya-os/proof.v1 each request carries - no sessions, verified fail-closed on every call.
Delegation Chains
Bottom-up verification from agent to root principal. Scope attenuation, budget constraints, and time bounds enforced at every edge.
Cryptographic Proofs
RFC 8785 canonicalization, SHA-256 hashing, and Ed25519 JWS signatures create tamper-evident audit records for every tool execution.
Confused Deputy Protection
KYA-OS protects against prompt injection attacks that try to trick agents into unauthorized actions. Even if an attacker convinces Claude Code to make a malicious request, the delegation's audience binding ensures the request is blocked before reaching its target.
Protocol Specifications
Cryptographic Standards
- Ed25519 signatures (RFC 8032)
- JSON Canonicalization (RFC 8785)
- HTTP Message Signatures (RFC 9421)
- Decentralized Identifiers (W3C DID)
Authorization Model
- UCAN-inspired delegation chains
- Scope attenuation (principle of least privilege)
- Time-bounded permissions
- Budget constraints (CRISP)