A developer going by mishrasanjeev has published Grantex, an open authorization protocol designed specifically for AI agents, positioning it as the OAuth 2.0 equivalent for the agentic web. Released under Apache 2.0 with a finalized v1.0 spec, the project addresses what its creator argues is a foundational gap in agent infrastructure: there is currently no standard mechanism for granting agents scoped, time-limited, revocable permissions on behalf of humans, nor any interoperable way for services to cryptographically verify that an acting agent is genuinely authorized. The protocol's three core primitives are agent identity via W3C Decentralized Identifiers (DIDs), delegated grant tokens implemented as RS256-signed JWTs with agent-specific claims, and an immutable append-only hash-chained audit trail. Revocation propagates in under one second and cascades through multi-agent delegation chains — a capability with no direct equivalent in OAuth 2.0.
Where OAuth 2.0 tokens carry standard claims like subject and audience, Grantex tokens add agent-specific fields: agt (agent DID), parentAgt, parentGrnt, and delegationDepth. Those primitives let a sub-agent in a complex pipeline cryptographically prove it was legitimately spawned by an authorized parent. The protocol explicitly frames itself as complementary to Anthropic's Model Context Protocol rather than a competitor: MCP handles tool connectivity while Grantex handles trust and authorization. Offline token verification via published JWKS endpoints means services can validate Grantex tokens without any runtime dependency on Grantex infrastructure, directly mirroring OAuth 2.0's deployment architecture to ease adoption.
The project ships a notably broad ecosystem at launch: TypeScript, Python, and Go SDKs, a CLI, and first-class framework integrations covering LangChain, AutoGen, CrewAI, Vercel AI, the OpenAI Agents SDK, Google's ADK, and MCP — seven platforms. Enterprise features include a policy engine, anomaly detection, SOC 2 and GDPR compliance exports, OpenTelemetry integration, and Infrastructure-as-Code support via Terraform and Pulumi providers. The trust stack layers in FIDO2/WebAuthn, W3C Verifiable Credentials, and SD-JWTs alongside the DID system, building on ratified standards rather than proprietary identity primitives.
mishrasanjeev says he has submitted an IETF Internet-Draft targeting the same standards body that ratified OAuth 2.0 (RFC 6749) and JWT (RFC 7519) — Agent Wars has not independently confirmed the draft's publication. He has named W3C and CNCF as alternative neutral homes for the spec. The broad integration coverage across seven orchestration platforms at launch looks like a calculated land-grab ahead of <a href="/news/2026-03-14-aip-agent-intent-protocol-cryptographic-identity">any competing protocol establishing a foothold</a>. Whether Grantex gains traction without backing from identity incumbents like Okta or Auth0 depends largely on whether framework maintainers adopt it as a default rather than treat it as an optional plugin — and on whether the IETF draft actually advances.