Which JACS Path Should I Use?

Choose the smallest supported integration that matches the boundary you need to secure.

Start Here

If you need...Start hereWhy
Sign and verify JSON, files, or one-off artifactsQuick StartEstablish the agent identity and trust model first.
A ready-made local MCP server for Claude, Codex, or another MCP clientMCP Overview and jacs mcpFastest full server path; stdio only, no HTTP port.
Signed tool outputs inside LangChain / LangGraph on PythonPython Framework AdaptersAdd provenance without changing the rest of the app.
Signed tool outputs inside LangChain.js / LangGraph on NodeNode.js LangChain.jsSame pattern for TypeScript.
Secure existing MCP server/client codePython MCP or Node.js MCPWrap the transport or register JACS tools.
Sign Markdown or text in placeInline Text SignaturesSignature stays with the readable file; supports multi-signer review.
Attach provenance to PNG, JPEG, or WebP imagesImage and Media SignaturesSignature is embedded in the image; no sidecar JSON.
Sign and verify raw emailEmail Signing and VerificationRust API for .eml messages with field-level content hashes.
Cross-organization agent discovery and artifact exchangeA2A InteroperabilityUse A2A for agent-to-agent boundaries.
Multi-party approval or quorum workflowsMulti-Agent AgreementsAgreements are the right primitive for sign-off.

When You Probably Do Not Need JACS

  • Everything stays inside one service you control and logs are enough.
  • You only need integrity, not signer identity or third-party verification.
  • A plain checksum or database audit log already satisfies the requirement.
  1. Prototype with quickstart and simple sign/verify calls.
  2. Attach provenance at the boundary that already exists: file, API response, framework tool, MCP call, image, email, or A2A artifact.
  3. Add trust policy when other agents, services, or organizations enter the workflow.
  4. Add agreements, DNS, or attestations only when the deployment needs them.

Start with the boundary you need to secure now.