> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kavachos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# KavachOS

> Auth OS for AI agents. Identity, permissions, delegation, audit, and MCP OAuth in one TypeScript SDK.

**Auth for AI agents.** KavachOS gives every agent its own identity, checks permissions at call time, and writes an audit row for every decision. Plugs in after your human auth (Clerk, Auth.js, better-auth, or your own). Runs on Node, edge, Workers, Deno, and Bun.

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Agent in five minutes.
  </Card>

  <Card title="npm install" icon="terminal" href="/quickstart">
    `npm i kavachos`
  </Card>
</CardGroup>

```ts theme={"system"}
import { createKavach } from 'kavachos';

const kavach = await createKavach({
  database: { provider: 'sqlite', url: 'kavach.db' },
});

const agent = await kavach.agent.create({
  ownerId: user.id,
  name: 'code-reviewer',
  type: 'autonomous',
  permissions: [
    { resource: 'mcp:github:*', actions: ['read'] },
  ],
});

const { allowed, auditId } = await kavach.authorize(agent.id, {
  action: 'read',
  resource: 'mcp:github:repos',
});
```

## What's in the box

<Columns cols={3}>
  <div>
    **Agent identity** as a first-class entity, not an extension of a user.
  </div>

  <div>
    **Resource wildcards** with rate limits, time windows, and IP allowlists.
  </div>

  <div>
    **Delegation chains** with depth, expiry, and cascading revocation.
  </div>

  <div>
    **Append-only audit** with JSON and CSV export.
  </div>

  <div>
    **MCP OAuth 2.1** authorization server, PKCE and DCR built in.
  </div>

  <div>
    **Trust scoring** per agent with anomaly detection and budget caps.
  </div>

  <div>
    **Ten adapters** for Node, edge, Workers, Deno, Bun.
  </div>

  <div>
    **Four databases**: SQLite, Postgres, MySQL, Cloudflare D1.
  </div>

  <div>
    **Web Crypto only** in core, no Node-specific APIs.
  </div>
</Columns>

## How it fits with your stack

```mermaid theme={"system"}
flowchart LR
  User([Human user]) -->|signs in| HumanAuth[Clerk / Auth.js / better-auth]
  HumanAuth -->|user ID| Kavach[KavachOS]
  Kavach -->|agent.create| Agents[(Agents)]
  Kavach -->|authorize| Decision{allowed?}
  Decision -->|yes| Tools[MCP servers, APIs, databases]
  Decision -.->|logged either way| Audit[(Audit trail)]
```

<Info>
  KavachOS does not replace your human auth. It does not handle login forms, password resets, or social OAuth for users. It starts where human auth ends, at the point your product spins up an agent to act on a user's behalf.
</Info>

## Pick your framework

<CardGroup cols={4}>
  <Card title="Next.js" icon="https://mintcdn.com/glincker/HCepWcwRV4NkDcKv/brand-icons/nextdotjs.svg?fit=max&auto=format&n=HCepWcwRV4NkDcKv&q=85&s=f0cc7e25920e30e38244119c094828b9" href="/adapters/nextjs" width="24" height="24" data-path="brand-icons/nextdotjs.svg">
    App Router and Pages.
  </Card>

  <Card title="Hono" icon="https://mintcdn.com/glincker/HCepWcwRV4NkDcKv/brand-icons/hono.svg?fit=max&auto=format&n=HCepWcwRV4NkDcKv&q=85&s=7239faee8b017493e32eac94989a3939" href="/adapters/hono" width="24" height="24" data-path="brand-icons/hono.svg">
    Workers, Deno, Bun.
  </Card>

  <Card title="Express" icon="https://mintcdn.com/glincker/HCepWcwRV4NkDcKv/brand-icons/express.svg?fit=max&auto=format&n=HCepWcwRV4NkDcKv&q=85&s=817f8590ed8c4e37cce5618f6ceace1c" href="/adapters/express" width="24" height="24" data-path="brand-icons/express.svg">
    Classic Node handlers.
  </Card>

  <Card title="Fastify" icon="https://mintcdn.com/glincker/HCepWcwRV4NkDcKv/brand-icons/fastify.svg?fit=max&auto=format&n=HCepWcwRV4NkDcKv&q=85&s=c7737f2ec89270f83729ffee9e1763b9" href="/adapters/fastify" width="24" height="24" data-path="brand-icons/fastify.svg">
    Plugins and decorators.
  </Card>

  <Card title="NestJS" icon="https://mintcdn.com/glincker/HCepWcwRV4NkDcKv/brand-icons/nestjs.svg?fit=max&auto=format&n=HCepWcwRV4NkDcKv&q=85&s=236e06766e1bf716ff0a20f20e63991d" href="/adapters/nestjs" width="24" height="24" data-path="brand-icons/nestjs.svg">
    Guards and decorators.
  </Card>

  <Card title="Nuxt" icon="https://mintcdn.com/glincker/HCepWcwRV4NkDcKv/brand-icons/nuxt.svg?fit=max&auto=format&n=HCepWcwRV4NkDcKv&q=85&s=bf06e0d2f934f93e36dd97e57b8da5ba" href="/adapters/nuxt" width="24" height="24" data-path="brand-icons/nuxt.svg">
    Server routes.
  </Card>

  <Card title="SvelteKit" icon="https://mintcdn.com/glincker/HCepWcwRV4NkDcKv/brand-icons/svelte.svg?fit=max&auto=format&n=HCepWcwRV4NkDcKv&q=85&s=8935cc45c851159f1f0cbcdefb73e2aa" href="/adapters/sveltekit" width="24" height="24" data-path="brand-icons/svelte.svg">
    Hooks and endpoints.
  </Card>

  <Card title="Astro" icon="https://mintcdn.com/glincker/HCepWcwRV4NkDcKv/brand-icons/astro.svg?fit=max&auto=format&n=HCepWcwRV4NkDcKv&q=85&s=9fa26c4cf28d569b45a36fbd07ef7c1c" href="/adapters/astro" width="24" height="24" data-path="brand-icons/astro.svg">
    Server islands.
  </Card>
</CardGroup>

## The six primitives

<CardGroup cols={2}>
  <Card title="Agent identity" icon="robot" href="/agents">
    Bearer tokens (`kv_...`), rotation, expiry. SHA-256 hashed at rest.
  </Card>

  <Card title="Permission engine" icon="shield-halved" href="/permissions">
    Resource wildcards, rate limits, time windows, IP allowlists, approval gates.
  </Card>

  <Card title="Delegation" icon="link" href="/delegation">
    Orchestrator delegates a subset to a sub-agent with depth and expiry. Revocation cascades.
  </Card>

  <Card title="Audit trail" icon="scroll" href="/audit">
    Every `authorize()` writes agent, user, resource, action, result, duration.
  </Card>

  <Card title="MCP OAuth 2.1" icon="globe" href="/mcp">
    Spec-compliant AS with PKCE S256, RFC 9728, RFC 7591.
  </Card>

  <Card title="Trust scoring" icon="chart-line" href="/trust">
    Nine-factor score per agent. Anomaly detection and budget policies on top.
  </Card>
</CardGroup>

## Switching from another auth library

<CardGroup cols={2}>
  <Card title="From better-auth" icon="arrow-right" href="/migrate/from-better-auth">
    Concepts map, code diffs, data migration SQL.
  </Card>

  <Card title="From Clerk" icon="arrow-right" href="/migrate/from-clerk">
    Hooks, middleware, Clerk data export, rollout plan.
  </Card>
</CardGroup>

<Tip>
  New releases land on [GitHub](https://github.com/kavachos/kavachos/releases) every week or two. Watch the repo or follow [@thegdsks](https://x.com/thegdsks) for the highlights.
</Tip>