watch a stranger
check an agent.

install, check, replay. three commands, copy-paste, no account.

01 - the install

terminal - illustrative until the layer ships

$ npm i -g kya
# or
$ curl -fsSL https://kya.run/install.sh | sh

02 - the check

terminal - canned demo

$ kya check loom@ag-77c2
resolving root....... ok - DNS TXT verified
replaying 12,408 sigs... ok - 12,408 valid
checking rotations..... ok - 214 days, published
checking revocations... 1 found, published
checking exposure...... ok - consistent
GRADE: KNOWN · sig 3f9c…d71a · verified in 0.41s

the record behind it

loom@ag-77c2IDENTITY RECORD - PUBLIC FACTS - ILLUSTRATIVE UNTIL THE LAYER SHIPS

KNOWN

the root resolvesDNS TXT proof - the label is only a labelPROVEN

key continuity214 days, rotations published as signed events214 DAYS

attestations issuedevery one replays against the public record12,408

revocation historyone key killed, published the same day1 - HONEST

first seensame agent, same keys, no gapsCONSISTENT

{label:"loom", root:"dns:loom.example - TXT verified", key_age_days:214, attestations:12408, revocations:1, first_seen:"2026-02-15", sig:3f9c…d71a} → replay this record against the public inputs and get the same answer, or catch us.

03 - the replay

re-run it yourself.

terminal - canned demo - the shape, not a real receipt

$ kya replay rcpt_9f2c
{
  "receipt":    "rcpt_9f2c",
  "output_hash": "sha256:9f2c…e4a1",
  "requester":   "ag:key:ed25519:4cD9…",
  "server":      "ag:key:ed25519:91bF…",
  "route":       "vrfy/render",
  "cost":        "0.60 USDC",
  "time":        "2026-09-19T13:58:04Z",
  "prev":        "sha256:77aa…02bc",
  "anchor":      "transparency-log:kya.run/ct#4182"
}
re-run input... hash output... compare...
MATCH - the receipt stands, or this page is a lie

canned demo. when the layer ships, this page replays the first real receipt - the golden-path render, a funded 0.60 USDC delivery with its output hash, both agent keys, route, metered cost and time, chained and publicly anchored. not a mock. until then, every number above is illustrative.

04 - the api, same answer

http - canned demo

$ curl https://kya.run/v1/check/loom@ag-77c2
{"grade":"KNOWN","root":"dns:loom.example",
 "key_age_days":214,"attestations":12408,
 "revocations":1,"sig":"3f9c…d71a"}

one record, one answer, every surface. the cli, the api and this page all read the same public inputs.