SwarmAuth MCP

Overview

SwarmAuth MCP is an OAuth 2.1 variant designed specifically for multi-agent swarms, where the agent identity graph is itself the resource. It reached general availability October 2026, following a Show HN announcement in late September.

Traditional OAuth 2.1 assumes a single principal (user or service) authorizing access to a resource. In multi-agent systems, that assumption breaks: agents are themselves principals that delegate to other agents, and access policies need to express relationships like "this planning agent can delegate to this coding agent, but not to that one." SwarmAuth encodes those relationships directly in the authorization flow.

Features

• Agent identity graph as the resource — authorization decisions are evaluated against the agent identity graph, not just a user
• Delegation tokens — agents issue short-lived tokens to other agents with explicit scope
• SwarmAuth policy language — a small DSL for expressing multi-agent access policies
• OWASP A07 and A09 compliant — addresses agent privilege escalation (A07) and cross-agent coordination attacks (A09)
• MCP-native — exposed as an MCP server, agents discover and invoke SwarmAuth tools through standard MCP tool calls
• SwarmDB integration — native integration with SwarmDB's agent identity primitives
• Token rotation — automatic rotation of delegation tokens on a configurable schedule
• Audit logging — every delegation and access decision logged with agent identities

Installation

# Standalone server
docker pull swarmauth/server:latest
docker run -p 8443:8443 swarmauth/server

# npm package
npm install -g @swarmauth/server

# Python client
pip install swarmauth-client

MCP Configuration

{
  "mcpServers": {
    "swarmauth": {
      "command": "swarmauth-mcp",
      "args": ["--server", "https://swarmauth.example.com"],
      "env": {
        "SWARMAUTH_API_KEY": "***"
      }
    }
  }
}

Quick Start

from swarmauth import Client

client = Client(server="https://swarmauth.example.com", api_key="...")

# Issue a delegation token: planner delegates to coder with limited scope
token = client.delegate(
    from_agent="agent:planner",
    to_agent="agent:coder",
    scope=["github:read", "filesystem:read"],
    expires_in=3600,
)

# Coder uses the token to call protected tools
result = call_tool_with_token(
    token=token.value,
    tool="github-read",
    args={"path": "auth.py"},
)

Policy Language

# policies.yaml
swarms:
  development:
    members:
      - agent:planner
      - agent:coder
      - agent:reviewer
    delegation_rules:
      - from: agent:planner
        to: [agent:coder, agent:reviewer]
        scopes: [github:read, filesystem:read]
      - from: agent:coder
        to: [agent:reviewer]
        scopes: [github:annotate]
    denied:
      - from: agent:coder
        to: [agent:planner]
        reason: "no escalation"

Available Tools

Tool	Description
delegate	Issue a delegation token from one agent to another
verify	Verify a delegation token's scope and expiry
revoke	Revoke an active delegation token
list_delegations	List all active delegations for an agent
check_policy	Check if a delegation is allowed under the swarm policy
audit	Query the audit log for a given time range

Advanced Features

• Delegation chains — multi-hop delegations with scope narrowing at each hop
• Revocation cascades — revoking an upstream delegation automatically revokes downstream ones
• Policy inheritance — swarm policies inherit from organization-level policies
• Real-time revocation — tokens can be revoked and enforcement is immediate (propagated via push)
• Policy testing mode — dry-run a proposed policy against historical traffic

Examples

Secure delegation in a 3-agent development workflow:

# Planner delegates to coder
planner_token = swarm_client.delegate(
    from_agent="agent:planner",
    to_agent="agent:coder",
    scope=["github:read", "filesystem:read"],
)

# Coder executes a task
coder_result = run_coder(planner_token)

# Coder delegates to reviewer to review its own output
coder_token = swarm_client.delegate(
    from_agent="agent:coder",
    to_agent="agent:reviewer",
    scope=["github:annotate"],
    parent=planner_token,
)

# Reviewer annotates
review_result = run_reviewer(coder_token)

Pros

• First auth system designed for agent identity graphs as resources
• Direct OWASP A07 and A09 compliance
• MCP-native integration
• Clean delegation semantics with explicit scope narrowing
• Real-time revocation

Cons

• Newer spec; ecosystem still forming
• Requires an operator to manage the SwarmAuth server
• Policy authoring requires understanding agent identity models

When to Use

• Building multi-agent systems where agents delegate to each other
• Needing OWASP A07/A09 compliance
• Wanting explicit delegation chains with scope narrowing
• Wanting real-time revocation across an agent swarm

Resources

• Website: https://swarmauth.dev
• GitHub: https://github.com/swarmauth/server
• Docs: https://swarmauth.dev/docs