Build an AI agent on KXCO Armature

Step-by-step

1. 1

   Generate a post-quantum identity

   Generate an ML-DSA-65 (NIST FIPS-204) keypair locally. The private key stays in the agent’s environment; a kid (key fingerprint) is derived from the public key for rotation tracking. This is the identity that makes the agent’s outputs unforgeable.

   npm install kxco-post-quantum
   
   import { generateKeyPair } from 'kxco-post-quantum'
   const { publicKey, privateKey, kid } = await generateKeyPair() // ML-DSA-65

2. 2

   Create the agent’s EVM wallet

   The agent uses a standard secp256k1 wallet for gas and on-chain settlement. The EVM address handles transactions; the ML-DSA-65 identity provides post-quantum-verifiable attribution. Two keys, two jobs.

   import { privateKeyToAccount } from 'viem/accounts'
   const account = privateKeyToAccount(process.env.AGENT_EVM_KEY)
   // account.address is the agent's on-chain identity for gas + settlement

3. 3

   Connect to Armature

   Point any EVM library at the Armature RPC. There is no KYC at the chain layer — the licensed operator running the platform handles eligibility at the application layer for regulated use.

   import { createWalletClient, http, defineChain } from 'viem'
   const armature = defineChain({
     id: 1111111, name: 'KXCO Armature',
     nativeCurrency: { name: 'ARMR', symbol: 'ARMR', decimals: 18 },
     rpcUrls: { default: { http: ['https://chain.kxco.ai/rpc'] } },
   })
   const wallet = createWalletClient({ account, chain: armature, transport: http() })

4. 4

   Sign the agent’s outputs

   Before delivering a result, the agent signs it with its ML-DSA-65 key. Any counterparty can verify the signature against the published public key — proving this exact identity produced the output, now or in decades, with no shared secret to leak.

   import { sign } from 'kxco-post-quantum'
   const signature = await sign(privateKey, outputBytes) // ML-DSA-65
   // recipient verifies with verify(publicKey, outputBytes, signature)

5. 5

   Pay another agent

   Settle agent-to-agent in ARMR over standard JSON-RPC — provably attributed, final in ~2s, with an on-chain audit trail. For a post-quantum-authorized transfer, route an ML-DSA-65 signed intent through the KXCO relay, which verifies the signature off-chain and anchors the result on-chain.

   await wallet.sendTransaction({
     to: subAgentAddress,
     value: 1_000_000_000_000_000n, // ARMR (wei)
   })

6. 6

   Authenticate to APIs with the identity

   Replace bearer tokens with ML-DSA-65 per-request signatures using the kxco-post-quantum-webhook adapters (Express / Fastify / Hono / Workers / Vercel). The server stores only the public key, so every request is independently verifiable — nothing to rotate, nothing to leak.

   npm install kxco-post-quantum-webhook

Why agents run on Armature

Human-oriented rails assume a person authorizes every transaction. Agents don’t work that way — Armature was built for non-human participants.

Frequently asked