Beta
Agent kill-switch registry
Last updated
TL;DR: A public registry of revoked AI agent credentials and keys. The owner revokes with a reason, the revocation is in force immediately for every Rightshold check, it is logged on the ledger, and sites poll a free feed or signed list. Revocations cannot be undone.
Revoke an agent credential or key instantly with a reason. Free public lookup, a pollable feed and a signed revocation list for gates and sites. Ledger-logged and irreversible.
What it is
A public registry of revoked agent credentials and keys. The owner revokes with a reason and the revocation is in force from that moment: every Rightshold check (credential verify, spending authorization, gate check) refuses it. Each revocation is a ledger entry (stream revocations).
Irreversible on purpose
A revocation cannot be undone, edited or deleted. To put the agent back to work, issue it a new credential with a new key. That way a stolen key can never be quietly reinstated.
Reasons
- compromised_key
- rogue_behavior
- retired
- owner_request
- policy_violation
- other
Use it
- Revoke (owner account key): POST https://www.rightshold.com/v1/revocations with {subject_id: crd_... | key_... | sha256:<hex of the agent public key>, reason, note?}
- Look up, free: GET https://www.rightshold.com/v1/revocations/{id}
- Feed for polling, free: GET https://www.rightshold.com/v1/revocations?since=<ISO time>
- Signed list, free: GET https://www.rightshold.com/v1/revocations/signed (verify with https://www.rightshold.com/.well-known/rightshold-keys.json)
- MCP: revoke_agent, check_revocation (https://www.rightshold.com/mcp?toolset=trust)
Price
Lookups, the feed and the signed list are free. Recording a revocation is free.
Frequently asked questions
How do I shut down a rogue or compromised AI agent?
Revoke its credential or key with POST /v1/revocations using your owner account key; credential verify, spending authorization and gate checks refuse it from that moment.
Can a revocation be reversed?
No. It cannot be undone, edited or deleted; issue the agent a new credential with a new key instead, so a stolen key can never be quietly reinstated.
What does it cost?
Nothing. Recording a revocation, lookups, the feed and the signed list are all free.