Skip to main content

Authorized use only. Use this tool solely on systems, tokens, and assets you own or are explicitly permitted to test — credential extraction, signature forging, and unauthorized access are prohibited by our Acceptable Use Policy.

Agent Name Service (ANS) Name Parser & Builder

The Agent Name Service gives AI agents verifiable, versioned names like ans://v1.0.0.my-agent.example.com backed by a registry and a public transparency log. Parse a name to check its structure, or build a valid one for an agent you are registering. 100% client-side.

ANS name

Scheme

ans://

Version

v1

Agent name

0.0.my-agent.example

Bound domain

example.com

DNS form

v1.0.0.my-agent.example.com

Versionless form

0.0.my-agent.example.example.com

First label is not a valid semantic version (X.Y.Z). In ans:// names the version comes first: ans://v1.0.0.agent.domain.tld

How the Agent Name Service works

Registry + transparency log. An ANS operator runs a Registration Authority (RA) that accepts agent registrations and a Transparency Log (TL) - an append-only Merkle tree of every registration, update and revocation. Anyone can audit the log to prove no agent's history was silently rewritten.

Signed receipts. On registration the agent receives a SCITT COSE_Sign1 receipt - a signed statement of the agent's state at a point in time. Offline verifiers check receipts against published root keys without contacting the registry.

Identity for transport. Agents get identity certificates from the operator CA, enabling mTLS between agents, with optional Bring-Your-Own-Certificates and pinned TLSA records.

Where it is going. ANS originated in the OWASP GenAI Security Project and is being tracked as an IETF draft, with open-source SDKs in Go, Rust and Java. It is early: great time to reserve agent names on domains you control.

FAQ

What is the Agent Name Service (ANS)?

A DNS-like naming and trust layer for AI agents. Every registered agent gets a versioned name (ans://v1.0.0.my-agent.example.com), a public append-only event history, and signed receipts that others can verify offline. It answers: is this agent really who it claims to be, and who controls it?

What is the ans:// name format?

A scheme prefix, a semantic version label, the agent name labels, and a domain you control: ans://<version>.<agent-name>.<domain>. Each label follows DNS rules (lowercase letters, digits, hyphens; max 63 chars). Versioning in the name lets callers pin a known-good agent revision.

How is ANS different from DNS or ENS?

DNS names locate servers; ANS names locate agents and bind them to verifiable identity material (certificates, keys, receipts) plus an auditable lifecycle log. ENS is blockchain-based; ANS uses a registry, transparency log and X.509-style certificates, closer to how the web PKI works than to on-chain naming.

Does this tool talk to an ANS registry?

No. Parsing, validation and building happen entirely in your browser - nothing is uploaded. To register a name for real, run an ANS Registration Authority (the reference implementation is open source) or use an operator's public registry.

Continue with

Passkey Address Deriver

Derive EVM addresses from P-256 passkey public keys. For Ritual Chain TxPasskey and WebAuthn wallets.

DKMS Key Visualizer

Visualize how Ritual agents derive identity keys via DKMS from TEE-held roots to purpose-specific keys.

X402 Payment Encoder

Encode and decode X402 payment payloads for agent-to-agent transactions. Build HTTP 402 challenges.