Open-source KYE Protocol™
Apache 2.0 SDKs. CC-BY-4.0 vocab. No runtime lock-in.
SDKs (TypeScript / Python / Go), CLI, Conformance Pack verifier, Shadow Mode SDK, schemas, OpenAPI, vocabulary — everything you need to integrate KYE Protocol™ locally. The operational engines (Authority Gap detection, Guard Recommendation, drift detection, KYE Native Search Engine™, KYE Memory Engine™, KYE Data Mapping Agent™, KYE Reporting Engine™) ship as paid services on the hosted Cloud; the wire contract + verification surface are 100% open.
Plain Q&A
Short questions. Short answers.
- What is open? Schemas, vocab, SDKs, verifier.
- What is closed? Nothing in the protocol layer.
- Which licence? Apache 2.0 for code. CC-BY-4.0 for vocab.
- Where is the source? On GitHub. KYE-Protocol org.
- Can I fork? Yes.
- Can I contribute? Yes. Open a PR.
- Will you take my fix? Yes if it follows the constitution.
- Is the runtime open? Reference Gateway is. Hardened build is paid.
Plain take
Apache 2.0 SDKs. CC-BY-4.0 vocab. No runtime lock-in.
- Three SDKs. One protocol. Same names.
- Schemas and vocab versioned on GitHub.
- Public JWKS. Open verifier.
- Bring your own runtime.
Why this is open source
One sentence. Plain words. No jargon.
Trust without lock-in
Banks, regulators and auditors need to verify what they're running. SDKs + schemas + wire-format are Apache-2.0 + CC-BY-4.0 so anyone can read, fork, certify. The paid Cloud runs the operational engines (Authority Gap detection, Guard Recommendation, drift) — the wire-format you bind to is yours forever.
Audit-defensible by construction
Every package above has an open spec under internal mirrored to kye-protocol.github.io. Customer auditors can compile, conformance-test, and embed in their own change-control without a vendor NDA.
15 packages, 6 stakeholders
Each SDK has stakeholder labels (Developer · Integrator · Auditor · Regulator · Consultant · Contributor) — use the filter chips above. Coverage: TypeScript · Python · Go · CLI · Conformance verifier · Shadow Mode SDK · Schemas · OpenAPI · Webhook verifier · Vocabulary · ID format · Examples · Widget protocol.
Architecture at a glance
Short take. Big idea.
Get started in 60 seconds
Short take. Big idea.
TypeScript
Drop-in client for the KYE Gateway™. Auth-aware fetch with retries, evidence-pack download, decision replay.
Python
Async + sync clients, typed models for every KYE schema, Conformance Pack verifier built in.
Go
Zero-dep Go client. Webhook signature verification — implements the public vendor recipes; algorithm details not disclosed in this repository.
CLI
kye verify pack.bin · kye mint key · kye conformance run · kye replay <decision_id>.
Claude Code plugin
Run the Authority Finality™ Diagnostic from your IDE: /kye:diagnose · /kye:score · /kye:report · /kye:verify · /kye:framework-map. Score is free; signed envelope free 3/month with a free account; unlimited on the paid pilot.
Plugin skills & slash commands
Five deterministic commands, one shared background skill. The plugin loads the skill once at activation; every command executes against it.
/kye:diagnose
24 questions across 6 authority lenses (Entity Verification · Chain of Authority · Scoped Delegation · Runtime Policy Resolution · Evidence & Replay · Authority Finality™). Saves answers locally. Free.
/kye:score
Composite Authority Finality™ Score + per-lens scores. Renders a band (Pre-authority / Implicit / Developing / Strong / Authority Finality™). Local, unsigned. Free.
/kye:report
Signed kye.report.v1 envelope (Ed25519). Server-side seal at /v1/diagnostic/seal. Free tier: 3 signed reports per month per email; unlimited on the paid pilot.
/kye:verify
Verify any signed envelope offline against the published JWKS at kyeprotocol.com/.well-known/jwks.json. No account needed — anyone can verify. Free.
/kye:framework-map
Crosswalk any framework requirement (EU AI Act · DORA · GDPR · SOC 2 · ISO 27001/42001 · HIPAA · PCI DSS 4 · FedRAMP · HAARF · SR 11-7 · BCBS 239 …) to KYE™ artefacts via the NIST 800-53 Rev 5 hub. Deterministic markdown table. Free.
📚 Skill — Authority Finality™
The background knowledge the plugin loads once at activation: what the 6 lenses are, the 5 score bands, where Authority Finality™ sits in the market vs evidence-collection (Vanta · Drata · OneTrust), advisory (NextFi), and agent-orchestration (LangChain · CrewAI · Claude Agent SDK · OpenAI Agents SDK) layers.
Use cases
Short take. Big idea.
🏦 Banking — payment-issuing agent
Wrap an LLM payment agent in @kye/sdk; every submit_payment tool call routes through Authority + Purpose + Decision. Auditor downloads @kye/conformance-pack-verifier + replays a quarter of decisions offline.
⚖️ Regulator — supervisory pack
Bank's CRO ships an Evidence Pack URL to the regulator. Regulator opens it in the KYE Evidence Viewer (open-source PWA) — no vendor login, full decision walk-through, OSCAL export.
🏥 Healthcare — clinical decision support
A clinical-decision-support agent wraps its recommendation tool with kyeAgent.wrap(). Every recommendation carries a signed Decision Map; clinicians see the "why"; regulators get the integrity proof.
🛰️ Edge — disconnected vehicle fleet
Vehicles run the Edge Arbiter with a Compiled Authority Bundle. Off-grid decisions log to the Offline Evidence Log; sync to the cloud Audit Pilot when connectivity returns.
Contributing
Short take. Big idea.
Every package above accepts pull requests. The KYE Protocol™ specs live under internal in the mono-repo and are mirrored read-only to kye-protocol.github.io for offline reading.
How to contribute: open an issue on the package's GitHub repo · sign the CLA (one-click via GitHub OAuth) · submit a PR · CI runs the Conformance Pack against your change · two-maintainer review · merge.
FAQ
Short take. Big idea.
What's open source vs paid?
Wire-format + SDKs + schemas + Conformance Pack verifier + Shadow Mode SDK are open source. Operational engines — Authority Gap detector, Guard Recommendation, drift detection, Audit Pilot orchestration, KYE Native Search Engine™, KYE Memory Engine™, KYE Data Mapping Agent™, KYE Reporting Engine™ — ship as paid services on the hosted Cloud. You can always self-host the verification side; you'd build the operational side yourself if you want zero hosted dependency.
Can I fork the SDK?
Yes. Apache-2.0. Keep the LICENSE + NOTICE; the trademark rules (no using "KYE Protocol™" to label a non-conformant fork) are in trademarks.
Does the SDK send telemetry?
No silent telemetry. The only data the SDK sends is what your code explicitly hands it (decision payloads, evidence packs). All clients support KYE_DRY_RUN=true to print-only.
How are vulnerabilities handled?
Public via SECURITY.md in each repo. PGP key on /security.html. CVE disclosure within 7 days, fix within 30 unless coordinated extension. Severity follows CVSS v4.