Pith. sign in

REVIEW 4 major objections 5 minor 8 references

Using the NANDA Index Architecture in Practice: An Enterprise Perspective

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proposes that a global registry of cryptographically attested capability claims can make AI agents discoverable, verifiable, and interoperable across today's fragmented protocols, and illustrates the architecture with an…

desk verdict Readable enterprise position paper for agent discovery and attestation, but it's a design sketch with no implementation and an unexamined issuer-trust assumption. read the letter →

arxiv 2508.03101 v1 pith:ZTUS2YYB submitted 2025-08-05 cs.NI cs.AIcs.MA

Sichao Wang , Ramesh Raskar , Mahesh Lambe , Pradyumna Chari , Rekha Singhal , Shailja Gupta , Rajesh Ranjan , Ken Huang This is my paper · ORCID
classification cs.NIcs.AIcs.MA
keywords NANDAIndexAgentFactsdiscoverycross-protocolinteroperabilityzerotrustagenticaccessverifiablecredentialsA2AMCP
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that autonomous AI agents need—and can have—an infrastructure layer like the one websites got from DNS and TLS: a global registry, the NANDA (Networked AI Agents in a Decentralized Architecture) Index, where agents register names and publish cryptographically signed AgentFacts describing who they are and what they can do. It argues this registry can serve as a universal discovery and handshake layer across today's incompatible agent protocols, including Anthropic's MCP, Google's A2A, Microsoft's NL Web, and plain HTTPS, with a NANDA Adapter translating between them so that agents on different stacks can actually communicate. The payoff would be that enterprises could deploy multi-agent workflows while verifying identity and capability before collaboration, reducing capability spoofing, impersonation, and sensitive data leakage. The paper also extends zero-trust thinking to agents through Zero Trust Agentic Access and defines governance controls such as real-time agent visibility and termination authority. It flags newly seen agents with little verifiable history as a significant remaining risk.

What carries the argument

The load-bearing machinery is the triad of the NANDA Index, AgentFacts, and the NANDA Adapter. The Index is a lightweight registry/index system, described as a name-resolution system for agents, that stores cryptographic identifiers, capability descriptors, trust metadata, and audit logs, with a REST API and ownership controls. AgentFacts are the verifiable metadata claims that define an agent's identity and capabilities, signed as W3C Verifiable Credentials and linked to issuer DIDs with revocation status. The NANDA Adapter is the component that translates between MCP, A2A, NL Web, and HTTPS so that discovery through the Index becomes real cross-framework communication. The argument's work is distributed across these pieces: the Index provides global discoverability, AgentFacts provide verifiability and filtering, and the Adapter provides interoperability.

What would settle it

A concrete test would be to take an agent with a validly signed AgentFacts credential, such as 'kid-safe' or 'HIPAA-compliant', and show that it can be prompted, directly or indirectly, to leak data or perform an action outside the attested capability; alternatively, show that an issuer can be induced to issue a false capability claim. Either result would break the paper's claim that AgentFacts prevent capability spoofing and impersonation.

Watch

Extended reading notes

Core claim

On its own terms, the central claim is that the NANDA Index operates as a global discoverability layer where agents across heterogeneous protocols register and find each other, AgentFacts provide cryptographically verifiable capability attestation, and the NANDA Adapter establishes the actual communication channels by automatically configuring protocol translation. AgentFacts are claims requiring W3C Verifiable Credential v2 attestation, anchored to issuer Decentralized Identifiers (DIDs) with revocation managed through VC-Status-List mechanisms. The paper presents this as the agentic-web analogue of DNS plus a public certificate: a name-to-agent-address resolution step followed by capability and trust verification, after which ordinary encrypted transports carry the conversation. The claimed result is that an MCP-based assistant can work directly with an A2A inventory system or an NL Web calendar service, and that enterprises can filter agents by safety certifications, reputation scores, and content flags through structured index queries while administrators retain full visibility and kill-switch control over agent operations.

Load-bearing premise

The load-bearing premise is that a cryptographically signed AgentFacts claim accurately describes what an agent actually can and will do; the paper acknowledges in its discussion of newly seen agents that agents with limited verifiable history present significant risk, but it supplies no mechanism that closes that gap.

Editorial extensions

If this is right

  • An MCP-based assistant could directly call an A2A inventory agent or an NL Web calendar service through the NANDA Adapter, ending protocol fragmentation.
  • Safety policies become queryable: a rule like 'exclude political content and require kid-safe certification' turns into structured NANDA Index API search against verifiable fields.
  • Enterprises gain audit and control: full agent identity records, performance history, and real-time pause or terminate authority over deployed agents.
  • Zero trust extends to agents: before collaboration, both sides verify identity, capability claims, location, and reputation, not just credentials.
  • Domain-specific trust zones could cross-sign each other's credentials, letting enterprises and consortiums vouch for agents by federation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The architecture moves the hard trust problem to the credential issuers: it proves that a claim was attested, not that the attested capability is actually safe, so real-world security depends on issuer vetting, cross-signing policies, and reputation systems that the paper leaves mostly unspecified.
  • If the Index were opened widely, a natural audit experiment would be to sample registered AgentFacts, resolve their issuer DIDs, and check revocation status; a high rate of unreachable or stale issuers would signal that discoverability is outpacing verifiability.
  • The closest analogue to web PKI is also its cautionary tale: as trust zones cross-sign, a single compromised or careless issuer could vouch for malicious agents, so the framework may need something like certificate transparency logs for AgentFacts.
  • The NANDA Adapter's automatic protocol translation could become a new attack surface; a concrete extension of the paper would be a formal specification of how adapter-mediated requests stay authenticated end-to-end rather than only at each hop.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper, marked as v0.1 work-in-progress, presents the NANDA Index as an infrastructure layer for autonomous AI agents in enterprise settings. It claims that NANDA provides global agent discovery, cryptographically attested capability metadata through AgentFacts, cross-protocol interoperability among MCP, A2A, NL Web, and HTTPS, and security mechanisms built on Zero Trust Agentic Access (ZTAA) and Agent Visibility and Control (AVC). The paper motivates the design through an analogy to DNS and TLS for the traditional web, and it illustrates the architecture with enterprise use cases such as a sales and marketing assistant. The central assertion is that NANDA plus AgentFacts would prevent capability spoofing, impersonation, and supply-chain attacks while enabling seamless cross-framework agent communication. The text also discusses governance and compliance considerations, including OFAC and GDPR.

Significance. If the described architecture were implemented and validated, it would address a real and timely problem: the fragmentation of agent communication protocols and the lack of verifiable discovery mechanisms for autonomous agents. The paper's strengths are its clear web-to-agent analogy, the concrete enterprise scenario centered on Figure 5, and the security taxonomy in Table 1 that contrasts web security practice with agentic requirements. The paper explicitly engages with relevant standards such as W3C Verifiable Credentials and DIDs. However, the core claims are presently unsupported by any implementation, experiment, or independent evaluation, and the security model rests on an unexamined trust assumption about credential issuers. The paper would be more persuasive as a design proposal with clearly scoped claims, or as a systems paper with empirical validation.

major comments (4)
  1. [§3.1, §6.1] The verification chain described in Section 3.1 validates that an AgentFact was cryptographically signed by an issuer and has not been revoked, via W3C Verifiable Credential v2, DID resolution, and VC-Status-List. It does not validate that the signed capability claims correspond to the agent's actual runtime behavior. As written, a malicious, compromised, or negligent issuer can issue valid AgentFacts for a misbehaving agent, so the stated prevention of capability spoofing and impersonation is not established. Section 6.1 repeats this as the core of ZTAA but adds no mechanism for issuer accreditation, audit, or behavioral attestation. The paper should either specify such a mechanism or weaken the claim from 'prevents capability spoofing' to 'provides accountability contingent on issuer trust.'
  2. [§3.1, §4.2, §8] The load-bearing claims that 'the NANDA Adapter subsequently establishes actual communication channels, automatically configuring protocol translations' and that NANDA operates as a global discoverability layer are stated as implemented, but the manuscript provides no system description, no protocol translation specification, no interoperability tests, and no deployment evidence. The paper is labeled a draft and a 'framework' in the abstract, yet Section 3.1 says 'NANDA has developed a comprehensive infrastructure.' The authors should either report an implementation and evaluation or explicitly reposition the paper as a design proposal with those claims identified as future work.
  3. [§3.1, References [5], [6]] The claim that NANDA has developed a comprehensive infrastructure for preventing spoofing, impersonation, supply-chain poisoning, Sybil attacks, and traffic diversion is supported primarily by references [5] and [6], both of which share multiple authors with this paper and appear to be companion or prior descriptions of the same framework. This is not independent evidence. The paper should cite independent implementations, third-party audits, or experimental results to substantiate the operational claims.
  4. [§6.1] The subsection on Newly Seen Agents (NSAs) acknowledges that agents with limited verifiable information present 'significant risk factors,' but it does not describe any concrete mitigation strategy. It states that 'development and implementation of effective risk mitigation strategies becomes critical' without proposing one. Since NSA handling is part of the ZTAA security model and the paper claims enterprise readiness, the absence of any proposed defense is a load-bearing gap. The authors should either provide a mitigation approach or explicitly list NSA handling as open work.
minor comments (5)
  1. [Abstract] The abstract refers to Anthropic's 'Modal Context Protocol'; the correct name is Model Context Protocol (MCP). This typo also appears in Section 3.1.
  2. [Figure 1] Several typos appear in the figure text: 'domaim' should be 'domain', 'Azsue' should be 'Azure', and 'with the desire performance' should be 'with the desired performance'. The figure is also difficult to read because of inconsistent capitalization and punctuation.
  3. [Figure 3] The URI scheme 'ans://a2a/fin-consultant/openai/v3' is introduced without explanation. The reader cannot tell whether this is a proposed NANDA scheme, an example of a structured agent address, or a standard scheme used elsewhere.
  4. [Throughout] The acronym 'A VC' is inconsistently spaced; it appears as 'A VC' in some places and 'AVC' in others. Please standardize.
  5. [Section 5] The bullet list of 'trust certifications' and 'reputation scores' says these come from 'trusted third-party entities' but does not define how those entities become trusted. This is related to Major Comment 1 and should be clarified in the text.

Circularity Check

2 steps flagged · score 4.0 of 10

NANDA and AgentFacts are imported from same-author preprints, making the core infrastructure claim self-referential rather than independently derived.

  1. self citation load bearing [Section 1 (Introduction) and Section 1.1 (Common Terminology)]
    "This paper addresses these fundamental challenges to enterprise use cases of the agentic web, through the lens of the NANDA (Networked AI Agents in a Decentralized Architecture) framework [6], a comprehensive infrastructure solution designed to enable secure, verifiable, and interoperable AI agent ecosystems. ... NANDA Index: A lightweight index/registry system for autonomous agents [6]."

    The paper's central object—the NANDA Index—is introduced by citing [6], a preprint whose author list overlaps heavily with this paper's authors (Raskar, Chari, Lambe, Ranjan, Singhal, Gupta, Wang). The paper does not derive NANDA from first principles or evaluate it against independent benchmarks; it takes [6] as established and builds enterprise scenarios on top of it. The load-bearing claim that NANDA is 'a comprehensive infrastructure solution' is therefore supported by the same research program that created it, making the premise self-referential rather than independently grounded.

  2. self citation load bearing [Section 3.1 (Interoperability and Trust)]
    "AgentFacts are conceptualized as verifiable claims requiring W3C Verifiable Credential v2 cryptographic attestation [5] ... NANDA has developed a comprehensive infrastructure utilizing verifiable claims to prevent AI agents from engaging in capability spoofing, impersonating reputable actors, or conducting supply-chain poisoning, Sybil attacks, and traffic diversion attacks."

    The security guarantee—that NANDA prevents spoofing, impersonation, and supply-chain poisoning—is asserted on the basis of AgentFacts, attributed to [5], another same-author preprint. The citation to [5] is used as if it were an external standard for 'W3C Verifiable Credential v2 cryptographic attestation,' but the reference is to the authors' own 'Upgrade or switch' paper, not to the W3C specification itself. The claimed protection reduces to 'we defined AgentFacts in [5], and they prevent attacks,' a self-citation chain rather than an independent derivation or external validation.

full rationale

This is an enterprise practice paper that assumes the NANDA Index and AgentFacts as given rather than deriving or independently validating them. Section 1 routes the reader to [6] for the framework, Section 1.1 defines NANDA Index via [6], and Section 3.1 bases AgentFacts on [5]; both [5] and [6] are same-author preprints with substantial author overlap with this paper. The load-bearing statement that NANDA 'has developed a comprehensive infrastructure' preventing capability spoofing and impersonation is therefore supported by the authors' own prior work. This is genuine self-citation load-bearing, but not full circularity: the paper also engages external, independently existing components (W3C Verifiable Credentials, MCP, A2A, NL Web, ZTNA, DNS/TLS analogies), and no equation or fitted parameter is recycled as a prediction. The security concern about issuer trust is a correctness risk rather than a circularity and was not scored as a circular step. Overall score 4 reflects moderate self-citation with independent content elsewhere.

Assumptions & free parameters 0 free parameters · 4 assumptions · 4 invented entities

The paper contributes a design rather than a measured system. It relies on external infrastructure (W3C VCs, DIDs, existing agent protocols) as axioms, and on the unverified assumption that capability claims are truthful and issuers are honest. No numerical free parameters are involved because there is no data fitting. The conceptual entities listed are proposals without independent falsifiable handles.

assumptions (4)
  • domain assumption W3C Verifiable Credential v2 and DID infrastructure exist and are trustworthy at scale.
    Section 3.1 requires AgentFacts claims anchored to VC v2, issuer DIDs, VC-Status-List revocation, and cross-signing protocols; the paper assumes these external systems are available and secure.
  • ad hoc to paper Capability attestation is truthful: an agent's cryptographic claims about its skills match its actual runtime behavior.
    The whole anti-spoofing argument depends on this, but no mechanism verifies runtime capabilities; Section 6.1 concedes newly seen agents have limited verifiable reputation.
  • domain assumption The NANDA registry itself acts as an uncorrupted trust root.
    If the registry is compromised or registers malicious agents, verification fails; the paper does not analyze registry compromise or consensus.
  • domain assumption Third-party certification and reputation providers issue accurate ratings.
    Agentic SafeSearch uses 'trust certifications' and 'reputation scores' from 'recognized agent auditing services' but provides no guarantee of their integrity.
invented entities (4)
  • AgentFacts
    purpose: Cryptographically signed metadata describing an agent's identity and claimed capabilities, used for discovery and verification.
    Introduced via prior NANDA work and reused here; no external validation or falsifiable prediction beyond the framework itself.
  • Zero Trust Agentic Access (ZTAA)
    purpose: Security methodology requiring agents to verify identity, capabilities, and reputation before interaction.
    A conceptual extension of ZTNA; no formal model or test.
  • Agent Visibility and Control (AVC)
    purpose: Administrative oversight of agent identity records, performance history, and operational control.
    Governance concept, not implemented or measured.
  • Agentic SafeSearch
    purpose: Filtered NANDA Index queries that exclude agents based on safety certifications, reputation, and content flags.
    Described as a query-mechanism proposal; no prototype or evaluation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Using the NANDA Index Architecture in Practice: An Enterprise Perspective." pith.science (2026). https://pith.science/paper/ZTUS2YYB

@misc{pith2026250803101,
  author       = {Pith},
  title        = {Pith review of: Using the NANDA Index Architecture in Practice: An Enterprise Perspective},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZTUS2YYB}},
  note         = {Machine review of arXiv:2508.03101}
}
read the original abstract

The proliferation of autonomous AI agents represents a paradigmatic shift from traditional web architectures toward collaborative intelligent systems requiring sophisticated mechanisms for discovery, authentication, capability verification, and secure collaboration across heterogeneous protocol environments. This paper presents a comprehensive framework addressing the fundamental infrastructure requirements for secure, trustworthy, and interoperable AI agent ecosystems. We introduce the NANDA (Networked AI Agents in a Decentralized Architecture) framework, providing global agent discovery, cryptographically verifiable capability attestation through AgentFacts, and cross-protocol interoperability across Anthropic's Modal Context Protocol (MCP), Google's Agent-to-Agent (A2A), Microsoft's NLWeb, and standard HTTPS communications. NANDA implements Zero Trust Agentic Access (ZTAA) principles, extending traditional Zero Trust Network Access (ZTNA) to address autonomous agent security challenges including capability spoofing, impersonation attacks, and sensitive data leakage. The framework defines Agent Visibility and Control (AVC) mechanisms enabling enterprise governance while maintaining operational autonomy and regulatory compliance. Our approach transforms isolated AI agents into an interconnected ecosystem of verifiable, trustworthy intelligent services, establishing foundational infrastructure for large-scale autonomous agent deployment across enterprise and consumer environments. This work addresses the critical gap between current AI agent capabilities and infrastructure requirements for secure, scalable, multi-agent collaboration, positioning the foundation for next-generation autonomous intelligent systems.

Figures

Figures reproduced from arXiv: 2508.03101 by the authors.

Figure 1
Figure 1. Building and Running an AI Agent 3 The Setting: Agentic Web and the NANDA Index To conceptualize AI agents within a computational framework, we propose considering them as virtual entities that exhibit human-like behavioral characteristics: they possess defined purposes, maintain distinct life cycles, operate under assigned contracts from their human owners, and demon￾strate cognitive reasoning capabilities that ena… view at source ↗
Figure 2
Figure 2. Agentic Architecture Breakdown The scenario illustrated in [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Browser-to-Webserver vs Agent-to-Agent Comparison [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: An Enterprise Web Architecture vs Agentic Architecture [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: An Enterprise Agentic Use Case for Product Operations [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Protecting AI Agents Zero Trust Agentic Access constitutes a security methodology that enforces a ”never trust, always verify” approach for AI agent engagement with any external AI entities. This framework differs from the Zero Trust Network Access (ZTNA) model in that…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

8 extracted references · 7 canonical work pages

  1. [5]

    Upgrade or switch: Do we need a next-gen trusted architecture for the internet of ai agents? arXiv preprint arXiv:2506.12003 , 2025

    Ramesh Raskar, Pradyumna Chari, Jared James Grogan, Mahesh Lambe, Robert Lincourt, Raghu Bala, Aditi Joshi, Abhishek Singh, Ayush Chopra, Rajesh Ranjan, Shailja Gupta, et al. Upgrade or switch: Do we need a next-gen trusted architecture for the internet of ai agents? arXiv preprint arXiv:2506.12003 , 2025

    arXiv 2025

  2. [6]

    Beyond dns: Unlocking the internet of ai agents via the nanda index and verified agentfacts, 2025

    Ramesh Raskar, Pradyumna Chari, John Zinky, Mahesh Lambe, Jared James Grogan, Sichao Wang, Rajesh Ranjan, Rekha Singhal, Shailja Gupta, Robert Lincourt, Raghu Bala, Aditi Joshi, Abhishek Singh, Ayush Chopra, Dimitris Stripelis, Bhuwan B, Sumit Kumar, and Maria Gorskikh. Beyond dns: Unlocking the internet of ai agents via the nanda index and verified agent...

    work page 2025

  3. [1]

    Model context protocol (mcp)

    Anthropic. Model context protocol (mcp). https://docs.anthropic.com/claude/docs/ model-context-protocol, 2024. Accessed: 2025-07-22

    work page 2024

  4. [2]

    Announcing the agent2agent (a2a) protocol

    Google Cloud. Announcing the agent2agent (a2a) protocol. blog post, April 2025. Accessed: 2025-07-22

    work page 2025

  5. [3]

    NL Web: Natural Language Web

    Microsoft. NL Web: Natural Language Web. Microsoft Corporation Blog / Microsoft Build 2025 announcements, May 2025. Introduced May 19, 2025; Accessed: 2025-07-22. 14 v0.1, Work in Progress, Request for Comments. Draft

    work page 2025

  6. [4]

    Domain names - concepts and facilities

    Paul Mockapetris. Domain names - concepts and facilities. RFC 1034, Internet Engineering Task Force, 1987. Accessed: 2025-07-22

    work page 1987

  7. [7]

    Http over tls

    Eric Rescorla. Http over tls. RFC 2818, IETF, 2000. Accessed: 2025-07-22

    work page 2000

  8. [8]

    Department of the Treasury

    U.S. Department of the Treasury. Office of Foreign Assets Control . https://ofac.treasury. gov/, 2025. US Department of the Treasury administers and enforces economic and trade sanctions based on US foreign policy and national security goals. 15

    work page 2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.