Build an AI agent on KXCO Armature

Step-by-step

1. 1

   Generate a post-quantum identity

   Generate an ML-DSA-65 (NIST FIPS-204) keypair locally. The private key stays in the agent’s environment; a kid (key fingerprint) is derived from the public key for rotation tracking. This is the identity that makes the agent’s outputs unforgeable.

   npm install kxco-post-quantum
   
   import { generateKeyPair } from 'kxco-post-quantum'
   const { publicKey, privateKey, kid } = await generateKeyPair() // ML-DSA-65

2. 2

   Create the agent’s EVM wallet

   The agent uses a standard secp256k1 wallet for gas and on-chain settlement. The EVM address handles transactions; the ML-DSA-65 identity provides post-quantum-verifiable attribution. Two keys, two jobs.

   import { privateKeyToAccount } from 'viem/accounts'
   const account = privateKeyToAccount(process.env.AGENT_EVM_KEY)
   // account.address is the agent's on-chain identity for gas + settlement

3. 3

   Connect to Armature

   Point any EVM library at the Armature RPC. There is no KYC at the chain layer, the licensed operator running the platform handles eligibility at the application layer for regulated use.

   import { createWalletClient, http, defineChain } from 'viem'
   const armature = defineChain({
     id: 1111111, name: 'KXCO Armature',
     nativeCurrency: { name: 'ARMR', symbol: 'ARMR', decimals: 18 },
     rpcUrls: { default: { http: ['https://chain.kxco.ai/rpc'] } },
   })
   const wallet = createWalletClient({ account, chain: armature, transport: http() })

4. 4

   Sign the agent’s outputs

   Before delivering a result, the agent signs it with its ML-DSA-65 key. Any counterparty can verify the signature against the published public key, proving this exact identity produced the output, now or in decades, with no shared secret to leak.

   import { sign } from 'kxco-post-quantum'
   const signature = await sign(privateKey, outputBytes) // ML-DSA-65
   // recipient verifies with verify(publicKey, outputBytes, signature)

5. 5

   Pay another agent

   Settle agent-to-agent in ARMR over standard JSON-RPC, provably attributed, final in ~2s, with an on-chain audit trail. For a post-quantum-authorized transfer, route an ML-DSA-65 signed intent through the KXCO relay, which verifies the signature off-chain and anchors the result on-chain.

   await wallet.sendTransaction({
     to: subAgentAddress,
     value: 1_000_000_000_000_000n, // ARMR (wei)
   })

6. 6

   Authenticate to APIs with the identity

   Replace bearer tokens with ML-DSA-65 per-request signatures using the kxco-post-quantum-webhook adapters (Express / Fastify / Hono / Workers / Vercel). The server stores only the public key, so every request is independently verifiable, nothing to rotate, nothing to leak.

   npm install kxco-post-quantum-webhook

Why agents run on Armature

Human-oriented rails assume a person authorizes every transaction. Agents don’t work that way, Armature was built for non-human participants.

Frequently asked