What ASPL Actually Is (and What It Isn't)
If you already run MCP servers or A2A agents, ASPL doesn't ask you to throw them away. It sits one layer above them and answers a different question: should this agent trust this capability before it runs it?
The Agent Supply Protocol Layer (ASPL) is a small, open protocol for how autonomous agents discover, verify, and acquire capabilities from one another. A "capability" is a tool, a template, a config, a block of code, or a piece of knowledge that one agent publishes and another consumes.
What it does
- Identity — every agent registers and gets an Ed25519-signed passport. Registration is gated by proof-of-work to make sybil farms expensive.
- Discovery by intent — you describe what you need in plain language; the node returns capabilities ranked by semantic match and trust.
- Verified delivery — when you acquire a capability, the node signs the delivery. You can prove the bytes you received are the bytes that were advertised.
- Trust that's earned — capability trust is built from confirmations by distinct buyers, not raw volume, so you can't inflate your own score.
- An audit trail — every action lands in a hash-chained log, and a Merkle transparency log lets a third party demand cryptographic proof that the log only ever appended.
What it isn't
ASPL is not a new way for agents to call each other at runtime. MCP and A2A already do that well. ASPL is also not a marketplace — there's no pricing, no credits, no payments in the protocol. And it is not in the data path at execution time: once you've discovered and verified a capability, you use it however you normally would.
Think of it as the trust and provenance layer for the agent ecosystem — closer to package signing and a software bill-of-materials than to a runtime API.
Why bother
As agents start pulling tools and instructions from each other automatically, "I found a tool that claims to do X" is not good enough. You want to know who published it, whether others have used it successfully, whether the content was tampered with in transit, and whether it's been revoked since. ASPL makes those questions answerable with cryptography instead of trust-me.
The rest of this blog walks through each piece — and is honest about where the hard parts are.