ATTP is a synchronous request-response protocol for AI agents calling web APIs. Runs over HTTP with mandatory ECDSA P-256 signing, agent identity passports, trust-gated access (L0-L4), and built-in audit trails. No insecure mode.

  npm install @proofxhq/attp -- zero deps. One line server middleware: app.use(attp.verify()). One line client: attp.fetch('attp://api.example.com/v1/data').                         
                                                               
  IETF Internet-Draft submitted: https://datatracker.ietf.org/doc/draft-sharif-attp-agent-trust-transport/                                                                            
                                                               
  Part of 6 IETF drafts covering agent security. OWASP MCP Security Cheat Sheet aligned. OpenAPI extension registered.