badge

Quick start · Website · How it works · AGENTS.md · llms.txt · Skills · Discussions · All projects

Auth and agent identity, proven rather than assumed.

Badge is an agent employee, a packaged specialist agent with its own skills, memory and tests. It owns one job: auth. Coding agents use it through its skills, its MCP server and its command line. A scheduled job runs its evals and proposes fixes. A person makes every change.

Badge is part of an agent-native play for agent-native systems that can eventually be recursively self-improving and evolving, operated by agent employees.

badge is the auth employee for coding agents. It gets a real sign-in working in an app, picks an auth provider as a decision with prices, audits OAuth and MCP setups, triages SAML/SSO failures and plans provider migrations. Its one hard rule: an agent's authority is the strict intersection of the agent's and the user's permissions, never the union.

Tagline: Who you are, what you're allowed, proven — not assumed. Powered by Energy.

Use it from any coding agent

Claude Code: the plugin brings the skills, sub-agents, hooks and MCP server.

/plugin marketplace add naman10parikh/badge
/plugin install badge@badge

Its MCP server, Codex, Cursor, Gemini CLI, one skill and the command line

Its MCP server, in any MCP client:

claude mcp add --transport stdio badge -- npx -y -p github:naman10parikh/badge badge-mcp
codex mcp add badge -- npx -y -p github:naman10parikh/badge badge-mcp

Cursor (.cursor/mcp.json), Gemini CLI (.gemini/settings.json) and most other clients take the same command as JSON:

{
  "mcpServers": {
    "badge": {
      "command": "npx",
      "args": [
        "-y",
        "-p",
        "github:naman10parikh/badge",
        "badge-mcp"
      ]
    }
  }
}

Gemini CLI: the extension brings the context and the MCP server.

gemini extensions install https://github.com/naman10parikh/badge

One skill (5 in all, in skills/), in any agent that reads Agent Skills:

gemini skills install https://github.com/naman10parikh/badge --path skills/agent-auth-classifier
git clone --depth 1 https://github.com/naman10parikh/badge /tmp/badge && cp -r /tmp/badge/skills/agent-auth-classifier ~/.claude/skills/

The command line:

npx -y -p github:naman10parikh/badge badge --help

Codex, Cursor, OpenCode, GitHub Copilot and other agents read AGENTS.md; Claude Code reads CLAUDE.md and Gemini CLI reads GEMINI.md, which import it. llms.txt maps every surface for agents that read first.

Quick start

Run it straight from GitHub, with no clone:

npx -y -p github:naman10parikh/badge badge --help
npx -y -p github:naman10parikh/badge badge classify "an agent needs to call my MCP server" --json

From a clone (Node 20 or later):

pnpm install
pnpm build
node bin/badge classify "an agent needs to call my MCP server" --json
node bin/badge advise --use-case enterprise --mau 100000 --json
pnpm test          # 87 tests
pnpm run eval      # 14 golden tasks and a 51-row labelled classification set

classify answers with the plane, the problem class (P1 here), the default tool (Stytch Connected Apps) and the reason. A small local cockpit shows the same answers to a person: node cockpit/server.mjs, then open http://localhost:7788. Agents use the CLI and the MCP server.

How it works

Every command takes --json, and the same verbs are MCP tools on the badge-mcp server (stdio).

Command	MCP tool	What it does
badge init --provider clerk		Writes a working sign-in to protected-route flow into a Next.js app. Clerk by default; BetterAuth, WorkOS and Stytch also work.
badge classify "<task>"	badge_classify	Places the plane (human sign-in or agent and MCP auth) and classifies an agent-auth task as P1, P2, P3 or P4 before any tool is picked. This is badge's core verb.
badge advise --use-case enterprise --mau 100000	badge_advise	Returns a provider decision with price breakpoints and the enterprise checklist, not a feature table.
badge audit <path> --mcp	badge_audit	Runs the pitfall checklist: PKCE method, RFC 8707 audience binding, account-linking gate, rotation atomicity, exact redirects, alg=none.
badge saml-triage "<symptom>"	badge_saml_triage	Runs the 7-step SAML/SSO triage runbook.
badge migrate --from clerk --to betterauth	badge_migrate	Plans a dual-validation window and names the four casualties: sessions, SSO connections, social links and custom claims.
badge mcp-check <url>	badge_mcp_check	Walks an MCP server's OAuth discovery (PRM, ASM, DCR or CIMD, authorize, token, tools/list) and reports spec gaps.
badge runs		Summarises the run log, logs/runs.jsonl.

The commands are thin. The asset is the brain in brain/: judgment built from 16 named incidents, 35 taste stances and version-pinned CVEs, searched with BM25 (bash scripts/memory-search.sh "<query>"). Its spec target is MCP 2025-11-25, with CIMD preferred over DCR. badge does not do payments (that is penny), the login-box UI (pixel), the users-table schema (acorn) or deploy and CI (rocket).

Around the brain sit the parts of a full harness: a persona in identity/, five skills, the CLI, an auth-lint hook that blocks unsafe auth code before it is written, two sub-agents (a provider auditor and a migration planner), the MCP server, a task router, an eval pyramid, a run log, an E2B sandbox for the acceptance test (the CI runner is the fallback), and a daily self-improvement loop. Agents start at AGENTS.md; the machine map is llms.txt and the A2A agent card is .well-known/agent.json.

What it is made of

Every project in this fleet is graded on the same 11 harness components and on self-improvement. Each mark is backed by a file you can open.

Component	Grade	Where
Identity	✅	identity/SOUL.md:3
Memory	✅	memory/MEMORY.md:1 + scripts/memory-search.sh:1
Skills	✅	skills/agent-auth-classifier/SKILL.md:1
Tools/CLIs	✅	bin/badge:1
Hooks	✅	.claude/settings.json:4 + hooks/hooks.json:4
Sub-agents	✅	.claude/agents/badge-provider-auditor.md:1
MCPs	✅	bin/badge-mcp:1 + src/mcp/server.ts:30
Dispatch	✅	src/dispatch/route.ts:197 + .github/workflows/rsi.yml:12
Evals	✅	eval/run.mjs:1 + .github/workflows/ci.yml:64
Observability	✅	src/obs/runs.ts:39
Sandbox/Infra	✅	sandbox/run-in-sandbox.mjs:42
Self-improvement	✅	dsip.json:1 + .github/workflows/rsi.yml:39

✅ real and tested · 🟡 partial, with the reason in the row · ❌ absent

How it improves itself

It carries its own evals and a self-improvement contract, dsip.json, which says what it may change and how a change is judged. A scheduled job runs its evals and proposes fixes. A person makes every change. Lessons it learns are kept as rules in its memory files.

Part of a fleet

One of the projects by Naman Parikh. Each owns one part of an agent's harness, or of the product around an agent, and all of them follow one standard.

Related project	What it owns
AgentDial	Identity
WikiMem	Memory
Skillsmith	Skills
Agent Booster	Tools / CLIs
Hooksmith	Hooks
AgentCast	Sub-agents
Plugsmith	Plugins
Armory	MCPs and the component registry
AgentGrid	Dispatch
AgentSwarm	Dispatch
AgentBench	Evals
AgentMoney	Observability
Sandforge	Sandbox / Infra
Claude Harness	The whole harness, as a template

Community

Questions and ideas go to Discussions; bugs go to issues. Follow the work on X and LinkedIn.

Contributing and security

Read CONTRIBUTING.md. AI-assisted pull requests are welcome. Report a vulnerability privately, as SECURITY.md explains.

Star history

If it is useful to you, a star helps other people find it.

Contributors

License

MIT. See LICENSE.