Your agents need
their own auth.

const agent = await kavach.agent.create({
  name: "code-reviewer",
  type: "autonomous",
  permissions: [
    { resource: "mcp:github:*", actions: ["read"] },
    { resource: "mcp:slack:send", actions: ["execute"] },
  ],
});

const check = await kavach.authorize(agent.id, {
  action: "read",
  resource: "mcp:github:repos",
});
// => { allowed: true, auditId: "aud_..." }

import { mcpOAuthServer } from "kavachos/mcp";

const mcp = mcpOAuthServer({
  kavach,
  pkce: "S256",           // RFC 7636
  dynamicRegistration: true, // RFC 7591
  resourceIndicators: true,  // RFC 8707
});

// Hono / Express / Cloudflare Workers
app.use("/oauth/*", mcp.handler());

const report = await kavach.compliance.report({
  standard: "eu-ai-act",
  from: "2025-01-01",
  to: "2025-12-31",
});

// => {
//   summary: { totalActions: 48203, denied: 12 },
//   agentInventory: [...],
//   riskAssessment: { level: "limited" },
//   exportUrl: "https://...",
// }