TSP (Trust Spanning Protocol)

MCP and A2A let agents pick their partners.
Neither lets them verify a stranger.

This works great when that shared base exists. Inside your company. With services you've connected to. With partners you've onboarded.

For agentic AI to reach its true potential, this doesn't cut it.

Today's agents only work with partners you've already onboarded. Pre-registered OAuth apps. Pre-exchanged API keys. Pre-established federation.

The exciting use cases need more. A procurement agent reaching thousands of suppliers. A research agent querying services it's never seen. A student agent applying to universities abroad.

Right now, they can't. The leash is the auth system.

Agents need to make trust decisions: Is this counterparty legitimate? Can I rely on their response? Should I share sensitive data with them?

Example: Your agent is onboarding a new vendor. It needs to verify business registration, credit rating, certifications. Can it query registries directly and know the response is authentic?

If there's no pre-established relationship,
how do you establish trust?

Today, enterprises solve B2B trust with EDI networks, API partnerships, SAML federation. All require setup per relationship.

EDI, federation, API partnerships work for stable relationships. For agents connecting to new counterparties at runtime, we need something else.

When you look closely at cross-org agent communication, three specific gaps emerge:

How do two endpoints that have never met
establish trust without a shared authority?

This requires a different trust model altogether.

The current model: verify identity by phoning home to a central authority.

The alternative: verify directly using cryptographic proof. No phoning home.

Decentralized verification. The identifier itself proves control.

This model requires identifiers that are self-certifying: the identifier itself proves control, without calling home to an authority.

Both sides fetch each other's public keys. Now they can:

• Encrypt messages only the other can read
• Sign messages to prove authorship
• Verify the other's signatures

No OAuth handshake. No pre-registration. Both sides look up each other's public keys, check trust registries, and start communicating securely.

We have the building blocks: VIDs for identity, registries for legitimacy, credentials for authorization. What's missing is a protocol that ties them together.

TSP (Trust Spanning Protocol) is that protocol. A minimal layer for establishing trust between any two endpoints.

Developed by Trust over IP under Linux Foundation Decentralized Trust, with contributors from Futurewei, Gen Digital, and the decentralized identity community. The same ecosystem behind W3C DIDs and Verifiable Credentials.

Why "spanning"? Like IP in networking, TSP is a thin waist: one simple protocol that connects many things above (apps, agents, wallets) to many things below (different identifier types, key systems).

The ToIP model: TSP sits at Layer 2, enabling everything above it.

TSP doesn't care about transport (HTTPS, WebSocket, Bluetooth), identifiers (DIDs, KERI, X.509), or encoding (JSON, CBOR). It works with whatever you have.

There is no "TSP network." Like HTTP, it's a protocol you speak. Two parties speaking TSP establish trust directly.

Back to our example: your agent is onboarding a new vendor. No existing relationship. How does this work with TSP?

This demo showed A2A over TSP. A2A handles discovery and task semantics. TSP handles the trust layer underneath.

Same pattern applies to MCP. An agent connecting to a tool server it's never seen? TSP verifies the server's identity and encrypts the channel. MCP handles the tool protocol on top.

No shared authority. No pre-registration.
Just keys.

See TMCP/TA2A: Running AI Agent Protocols over TSP (Wenjing Chu, Futurewei) for the full technical walkthrough.

TSP handles the cryptographic layer. It doesn't handle everything.

TSP spec reached Revision 2 in November 2025. Developed under Linux Foundation Decentralized Trust.

Active integration work across different domains:

Don't sleep on this. The wallet and credential ecosystem has been building for nearly 10 years. It's not hype: it's infrastructure that's ready.

Decentralized identity meets agentic AI.
The plumbing is maturing.

Talks (ToIP Symposium, Nov 2025)

Spec & Code

Related Explainers