Credential Models

A detailed look at the different types of verifiable credentials used in MCP-I

Credentials

MCP-I uses W3C Verifiable Credentials (VCs) as the standard format for expressing claims about identity and delegation. The specification defines several credential models to address different requirements:

  1. Standard Delegation Credential: The core credential type for basic delegation
  2. Chained Delegation Credential: For multi-level delegation scenarios
  3. Enhanced Credential: For Level 3 implementations with additional security features
  4. Legacy Compatibility Credential: For interoperability with existing systems

Each model shares core properties while adding specific features for its intended use case.

Credential Selection Guidelines

When choosing a credential model for your implementation, consider:

Credential TypeUse CaseConformance LevelSecurity Level
Standard DelegationDirect agent authorizationLevel 1+Moderate to High
Chained DelegationMulti-level delegationLevel 2+Moderate to High
EnhancedComplex enterprise scenariosLevel 3Very High
Legacy CompatibilityIntegration with existing systemsLevel 1 onlyBasic

Implementation Examples

Creating a Standard Delegation Credential

import { createCredential } from "@mcp-i/credentials";

// Example function to create a standard delegation credential
async function createStandardDelegation(issuerDid, agentDid, scopes) {
  return await createCredential({
    type: "DelegationCredential",
    issuer: issuerDid,
    subject: agentDid,
    scope: scopes,
    expiresIn: "90d", // 90 days
    constraints: {
      environment: "production",
    },
  });
}

// Usage
const credential = await createStandardDelegation(
  "did:web:issuer.example.com",
  "did:key:z6MkhaSG3...",
  ["read:email", "write:calendar"]
);

Creating a Chained Delegation

import { createChainedDelegation } from "@mcp-i/credentials";

// Example function to create a chained delegation
async function delegateToSubAgent(parentCredential, subAgentDid, subsetScopes) {
  return await createChainedDelegation({
    parentCredential,
    subject: subAgentDid,
    scope: subsetScopes,
    expiresIn: "30d", // Must be <= parent expiration
  });
}

// Usage
const chainedCredential = await delegateToSubAgent(
  originalCredential,
  "did:key:z6MkhZgT8...",
  ["read:email"] // Subset of parent scopes
);

Credential Structures