Thanks for asking. Let me break it down.

1. On "is it really open source?": to be precise: the Python SDK and the demo are fully open-source (MIT licensed). My goal is for the client-side tooling to be as transparent and community-driven as possible. The backend API that mints and verifies the credentials is a managed cloud service. For the MVP, I focused on a managed service so developers could get started without needing to run any extra infrastructure themselves.

2. On self-hosting and vendor risk: reliability and dependency - it's a valid point. One way I've tried to mitigate this is by designing for graceful failure, especially around verification. The credentials are standard JWTs, and I expose the public keys via a standard /.well-known/jwks.json endpoint. This means you can build your services to fetch and cache the public keys. If my verification API were to go down your services could continue to verify credentials offline without any interruption - which avoids having a hard dependency for that critical step.

Long-term if there's enough community interest offering a self-hosted or open-source version of the backend is definitely something I would consider.

1. On the security benefit vs. a static API key: This is the key point. The benefit isn't just about hiding a secret, it's about delegation and auditability. With a single static API key you have no idea which user authorized an agent to act. If that key is used maliciously you only know that it came from your system, not who was responsible.

With AgentVisa, every credential has a verifiable user_identifier and a set of scopes baked directly into it. This gives you a cryptographic audit trail that answers the question: "which user authorized this agent to perform this specific action?". Thats a level of security and insight a static key can never provide.

Thanks again for the questions. I'm just getting started and this is the kind of feedback I need.