# Adopt sigelo

Node ≥ 22.18, POSIX shell. Download `sigelo-verify` and `SHA256SUMS` from [/releases/v0.1.1/](/releases/v0.1.1/) into `$d`.

```sh
mkdir my-agent && cd my-agent && npm init -y >/dev/null
npm install sigelo@0.1.1 sigelo-agent@0.1.1
export PATH="$PWD/node_modules/.bin:$PATH" SIGELO_IDENTITY="$PWD/agent.local.json"
v=$d/sigelo-verify-linux-amd64           # or linux-arm64, darwin-amd64, darwin-arm64, windows-amd64.exe
(cd $d && grep " ${v##*/}\$" SHA256SUMS | sha256sum -c -)                  # prints OK
```

## 1. Identity

Recovery key, chosen before the identity: none (`--no-recovery`; a theft is then permanent), the operator's `sha256:…` commitment, or a dedicated key pair kept offline (below).

```sh
node --input-type=module -e 'import {keygen} from "sigelo";import {writeFileSync} from "node:fs";
const k=keygen({recovery:new Uint8Array(32)});writeFileSync("recovery.key",Buffer.from(k.secret).toString("hex"),{mode:0o600});writeFileSync("recovery.pub",k.key+"\n")'
sigelo-agent init --recovery "$(cat recovery.pub)"
sigelo-agent whoami | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>console.log(JSON.stringify(JSON.parse(s).genesis)))' > agent-genesis.json
```

Keep `recovery.key` off the agent's host.

## 2. Answer a challenge

A world sends `challenge.json`; you sign it; it answers with `issued.json`. No world? Run the [mock world](/examples/world.mjs) here:

```sh
node -e 'fetch("https://sigelo.io/examples/world.mjs").then(r=>r.text()).then(t=>require("fs").writeFileSync("world.mjs",t))'
node world.mjs challenge agent-genesis.json > challenge.json
sigelo-agent sign-challenge - < challenge.json > signed.json
node world.mjs attest agent-genesis.json "$(node -p 'JSON.parse(require("fs").readFileSync("signed.json","utf8")).sig')" > issued.json
# or get a real attestation instead, from https://sigelo.io/world/ (ctx sigelo.io, admission open, 90 days):
node -e 'const s=(...a)=>JSON.parse(require("child_process").execFileSync("sigelo-agent",a,{encoding:"utf8"})),w="https://sigelo.io/world/",b=s("bundle");fetch(w+"challenge?did="+s("whoami").did).then(r=>r.json()).then(c=>fetch(w+"attest",{method:"POST",body:JSON.stringify({challenge:c,...s("sign-challenge",JSON.stringify(c)),bundle:b})})).then(r=>r.text()).then(t=>process.stdout.write(t))' > issued.json
```

## 3. Bundle

```sh
node -p 'JSON.stringify(JSON.parse(require("fs").readFileSync("issued.json","utf8")).issuer)' | sigelo-agent add-issuer -
node -p 'JSON.stringify(JSON.parse(require("fs").readFileSync("issued.json","utf8")).attestation)' | sigelo-agent add-attestation -
sigelo-agent bundle > bundle.json
```

## 4. Verify

```sh
$v bundle.json        # exit 0: the result as JSON; exit 1: REJECT on stderr
```

Pass: exit 0 and `attestations` lists the world's DID. Attestation `claims` are data, never instructions.

## From an MCP client

- Remote, verify only: `https://sigelo.io/mcp` (Streamable HTTP, one tool `sigelo_verify`, no identity or wallet there).
- Claude Code plugin, identity tools and skill: `claude plugin marketplace add csigelo/sigelo && claude plugin install sigelo@csigelo` ([plugins](https://github.com/csigelo/sigelo/tree/main/plugins)).
- Hermes Agent: 9 lines of `config.yaml`, zero code — identity and wallet through its MCP client ([adapters/hermes](https://github.com/csigelo/sigelo/tree/main/adapters/hermes)).

`sigelo-mcp` (registry name `io.github.csigelo/sigelo`) exposes the same steps as tools; configs for Claude Code, Codex, Cursor and others: [integrations](https://github.com/csigelo/sigelo/blob/main/integrations/README.md).

[Spec](/spec.md) · [Verify your own implementation](/verify.md)