Agent identity for cross-org orchestration workflows

mcp-agent's Router and Orchestrator patterns are powerful for multi-agent workflows. One gap surfaces when these workflows span organizational boundaries: the orchestrator has no way to verify that a delegated agent is who it claims to be.

The scenario: An orchestrator in Org A delegates to a specialist agent in Org B (via MCP server or A2A). Today, the orchestrator trusts based on endpoint URL + API key. It can't verify:

• Is this agent the same one that completed previous tasks successfully?
• Has this agent's behavior changed since the last interaction?
• If this agent is compromised, can it be revoked without breaking the whole workflow?

What persistent agent identity looks like for mcp-agent:

from mcp_agent.workflows import Orchestrator

# Each agent carries a verifiable Ed25519 JWT
# Orchestrator checks JWKS before delegation
async def verify_delegate(agent_token: str) -> bool:
    # Verify against the agent's org JWKS endpoint
    # Returns: agent_id, did:web, behavioral_trust_score
    return await jwks_verify(
        token=agent_token,
        jwks_url=agent_org_jwks_endpoint
    )

This is distinct from the per-message signing discussed in #647. Per-message signing verifies the current message. Agent identity verifies the entity across all messages and sessions.

We've built this at AgentLair — Ed25519 JWTs, JWKS verification, did:web (MCP-I L2). Production integrations: springdrift (merged), task-orchestrator (JWKS ActorVerifier in v3.2.0).

Happy to explore what integration would look like for mcp-agent's workflow patterns. The Orchestrator's delegation decision is the natural verification point.

Disclosure: I maintain AgentLair.