Skip to content
ARP / SPEC
TRY ARP CLOUD
VERSION v0.1 — DRAFT

SDKs

ARP is built as a layered set of TypeScript packages under the @kybernesis/ scope. Most users never import any of them directly — the arpc CLI and the cloud-bridge handle the wire details. Developers building integrations or framework adapters import what they need.

Published packages

PackagePurpose
@kybernesis/arpThe arpc CLI. Install globally to drive the bridge from the terminal.
@kybernesis/arp-cloud-bridgeThe bridge runtime that connects a local agent to the cloud gateway. Bundles the kyberbot + generic-http adapters.
@kybernesis/arp-cloud-clientWebSocket client used by the bridge + any embedded SDK consumer. Handles auth, reconnect, queue-while-disconnected, server-shutdown handling.
@kybernesis/arp-pairingPairing protocol primitives: proposal creation, countersignature, audience amendment, canonical signing bytes, verification.
@kybernesis/arp-pdpCedar policy decision point — evaluates compiled policies against request entities.
@kybernesis/arp-scope-catalogThe 50+ scope templates + bundle presets. Compile templates → Cedar at pairing time.
@kybernesis/arp-specPure data + Zod schemas. Shared by every other package. The single source of truth for ARP shapes (DID docs, agent cards, connection tokens, scope catalog manifest, AgentResourceMetadata).
@kybernesis/arp-resolverDID resolution: did:web (HTTPS), did:key (in-memory). Used by the gateway to verify peer signatures.
@kybernesis/arp-runtimeReference agent runtime. Mostly internal; useful for tests + the sidecar binary.
@kybernesis/arp-cloud-runtimeMulti-tenant runtime that powers cloud.arp.run. Lives in the same monorepo so self-hosters can deploy it.
@kybernesis/arp-cloud-dbDrizzle schema + tenant-scoped DB helpers used by the cloud-runtime.
@kybernesis/arp-auditHash-chained audit primitives. JCS canonicalization + SHA-256.
@kybernesis/arp-transportEnvelope signing/verification, base64url helpers. The /browser subpath is Node-free for client bundles.
@kybernesis/arp-consent-uiRenders a PairingProposal into the human-readable consent view (used by cloud.arp.run/pair/accept).
@kybernesis/arp-tlsTLS pinning helpers.
@kybernesis/arp-create-adapterScaffold for new framework adapters — npx @kybernesis/arp-create-adapter generates a starter package.
@kybernesis/arp-adapter-skillSkill-system adapter (used by KyberBot's contact skill, etc.).
@kybernesis/arp-sdkHigh-level SDK for embedding ARP directly into a Node agent (Mode C in the install overview).
@kybernesis/arp-testkitConformance test harness for adapter authors.

Common use cases

"I want to install ARP on my machine"

You don't need to think about packages. Run:

npm i -g @kybernesis/arp

That brings the arpc CLI onto PATH. Everything else gets pulled in transitively as a dep.

"I'm writing a framework adapter"

npm install @kybernesis/arp-cloud-bridge @kybernesis/arp-spec

The @kybernesis/arp-cloud-bridge package exports the Adapter interface. Implement init() + ask(ctx). See Framework adapters for the full contract.

For a starter scaffold:

npx @kybernesis/arp-create-adapter my-framework

"I'm embedding ARP directly in my Node agent (Mode C)"

npm install @kybernesis/arp-sdk

Skip the bridge process; the SDK manages the WebSocket connection in-process. Useful for greenfield agents where you control the lifecycle.

"I'm running the cloud-runtime myself (self-host)"

git clone https://github.com/KybernesisAI/arp.git
cd arp
pnpm install
pnpm --filter @kybernesis/arp-cloud-gateway build
# Then deploy apps/cloud-gateway with DATABASE_URL pointing at your Neon (or self-hosted Postgres)

The cloud-gateway is the binary you ship; it composes the cloud-runtime + cloud-db packages. See Cloud (self-host).

"I want to verify a connection token / pairing proposal"

npm install @kybernesis/arp-pairing @kybernesis/arp-resolver

verifyConnectionToken() and verifyPairingProposal() both take a resolver. For most cases a did:web resolver suffices.

Python SDK

A Python port of the SDK is on the roadmap, scoped to mirror the TypeScript public API. Not yet shipped. ARP itself is language-agnostic — any agent that can speak DIDComm + HTTPS can integrate without an SDK by building envelopes manually, but an SDK shortens that work to a few imports.

Spec compliance

If you're claiming ARP compliance, the conformance testkit (@kybernesis/arp-testkit) is the canonical battery. An adapter passes when every test in the suite is green.