API ReferenceBlogSign inGet started
GuidesDetectEnforceGovern
Concepts

The Ecosystem

How Vouched KYA, the KYA-OS protocol, and the KnowThat.ai registry relate, and which name means what

Vouched KYA sits inside a small ecosystem of products, protocols, and services whose names look similar but mean different things. This page is the map.

The pieces

Vouched (the parent company)
│
├── CHECKPOINT: the product you're reading about
│   ├── Detect   · engine, pixel, beacon, SDKs
│   ├── Enforce  · Cedar policies, edge Gateway
│   └── Govern   · delegations, consent, proofs (implements KYA-OS)
│
└── KnowThat.ai: runs the public agent registry at knowthat.ai
    └── agent profiles, claiming, reputation

KYA-OS (formerly MCP-I): the open identity protocol, the umbrella for everything below
├── kya-http/2 · KYA-OS over plain HTTP, for websites; no MCP connection needed
├── MCP        · KYA-OS on MCP connections between agents and MCP servers
└── SDK packages under the @kya-os/* npm scope
NameWhat it is
VouchedThe parent company of Vouched KYA and KnowThat.ai.
Vouched KYAThe platform: AI-agent detection, enforcement, and identity-based governance. What this documentation covers.
KYA-OS"Know Your Agent — Operating System." The umbrella identity protocol (DIDs, verifiable credentials, and delegation) plus the SDK brand and @kya-os/* npm scope. Websites use it over plain HTTP through the kya-http/2 profile, which needs no MCP connection; MCP servers use it over MCP. Stewarded in the open by the Decentralized Identity Foundation (DIF).
MCP-IKYA-OS's former name, still carried by the MCP server packages (@kya-os/mcp-i, @kya-os/mcp-i-cloudflare). Over MCP, KYA-OS rides the same identities, credentials, and delegations.
KnowThat.ai"Know That AI." A Vouched company, separately branded from Vouched KYA, that runs the public agent registry at knowthat.ai: agent profiles, ownership claiming, and reputation.

How they interact

  • Vouched KYA implements the KYA-OS protocol. The Govern pillar (delegations, proofs, consent) is Vouched KYA's implementation of the open protocol. Any agent that speaks KYA-OS can prove its identity to a Vouched KYA-protected resource; nothing about the protocol is proprietary to Vouched KYA.
  • The registry tracks reputation. KnowThat.ai scores each registered agent's reputation (0–100) from its recorded interactions.
  • Composed Cedar does not receive that score yet. A generic engine evaluator can accept reputation, but the production composed-policy projection does not pass it through, so deploy rejects Cedar rules that depend on it.
  • KYA-OS agent identities resolve publicly. A registered agent's did:web identity resolves through its knowthat.ai profile, which is how Vouched KYA verifies signatures from registry-listed agents.

A note on names you'll still encounter

AgentShield is Vouched KYA's former name. It survives in a few compatibility surfaces: the agentshield_user cookie and the window.AgentShield browser global. Same product, old label. New integrations should use the @kya-os/checkpoint-* packages; see Choose Your Integration.

One more name that's genuinely overloaded, Gateway:

  1. The edge Gateway: the DNS/CNAME reverse proxy that runs detection and enforcement on your web traffic. This is what "Gateway" means throughout the Enforce docs.
  2. The MCP Gateway (also called the Agentic Hub): the org-level Govern surface that authorizes agent tool-calls to MCP servers.

They are different systems that share a word. When in doubt, the Enforce pillar means the edge Gateway and the Govern pillar means the MCP Gateway.

If a term still isn't clear, check the Glossary: it disambiguates every name in the ecosystem.

Detection Semantics

What a persisted detection means per surface: row volume, confidence, session identity, absence, and how long a row takes to land

Detect

AI agent detection methods: Pixel, Beacon, Middleware, and Gateway

On this page

The piecesHow they interactA note on names you'll still encounter