Agent Privacy-Preserving Protocol - AP3

Agent Privacy-Preserving Protocol (AP3) is an open protocol that enables distributed collective intelligence, without sacrificing confidentiality and regulatory posture. Collective intelligence here means the capacity of autonomous agents, tools, humans, and institutions to reason jointly and accumulate shared context across organizational, jurisdictional, and vendor boundaries.

💡 Documentation: https://ap3-protocol.org

Individually capable agents are already here; what the ecosystem lacks is a substrate on which they can think and act together in a privacy preserving way. AP3 provides that layer to the existing stack. It is delivered as an extension to the open Agent2Agent (A2A) protocol in communication, integrates with Google Agent Development Kit (ADK) at the build stage and will expand support to other agentic frameworks.

AP3 is being designed to support most common inter-agent communication protocols including the Agent Communication Protocol (ACP, originated by IBM, hosted at the Linux Foundation under the Agentic AI Foundation), the Agent Gateway Protocol (AGP / SLIM, originated by Cisco, hosted at the Linux Foundation under AGNTCY), and emerging decentralized protocols such as the Agent Network Protocol (ANP, originated by the open-source ANP community).

Its cryptographic core - Secure Multi-Party Computation (SMPC) for privacy preserving compute, supplemented by Trusted Execution Environment (TEE) attestation for execution integrity, would turn cross-boundary collaboration into a verifiable, policy-bound computation rather than an implicit trust assumption. Collective agentic and human context thereby becomes a cryptographically guaranteed intelligence layer.

AP3 aims to address a core question in multi-agent systems (MAS):

Once multi-agent workflows span more than one trust domain, the engineering problem is no longer interoperability but governed execution: how do agents jointly compute, reason and collectively innovate over sensitive inputs, context graphs, and memory. In doing so each participant's data remains confidential, every contribution to the output is cryptographically attributable, and the computation is verifiable without a single trusted intermediary.

Each example has its own README with setup, Docker, and run instructions.

Full documentation lives at ap3-protocol.org.

Highlights:

• Installation Guide
• Configuration
• API Reference
• Architecture · Lifecycle · Roles
• Directives · Commitments · Operations
• Security model · FAQ
• Troubleshooting
• Roadmap

To preview the docs locally:

uv sync
uv pip install -r requirements.txt
uv run mkdocs serve

Build the static site into site/:

uv run mkdocs build --clean

ap3/
├── src/ap3/              # Core SDK: types, signing, services, A2A middleware
├── packages/
│   └── ap3-functions/    # Privacy operations (PSI, future MPC/HE primitives)
├── examples/             # Runnable examples (Python, A2A, ADK, web playground)
├── docs/                 # MkDocs site sources (architecture, SDK, codelabs)
├── tests/                # Unit + integration tests
└── .github/              # CI workflows, issue & PR templates

Contributions of all kinds are welcome — bug reports, fixes, new examples, docs, and new privacy operations.

1. Read CONTRIBUTING.md for development setup, linting, testing, and PR guidelines.
2. Skim CODE_OF_CONDUCT.md — we follow the Contributor Covenant.
3. For non-trivial changes, open an issue or discussion first so we can align on direction.

When you file an issue or open a PR, GitHub will load the matching template:

A quick pre-flight checklist before pushing:

• uv run ruff check . and uv run ruff format . are clean
• uv run pytest -v passes
• Tests added or updated for behavior changes
• No secrets, signing keys, or local state in the diff

• Bugs & actionable feature requests — GitHub Issues
• Docs — ap3-protocol.org
• Support — see SUPPORT.md

Please do not open public issues for security vulnerabilities. Use GitHub's Private Vulnerability Reporting instead. Full disclosure process is documented in SECURITY.md.

Licensed under the Apache License, Version 2.0 — see LICENSE.

Agent Privacy-Preserving Protocol - AP3 is an open source project under LF Decentralized Trust lab, contributed by Silence Laboratories. It is licensed under the Apache License 2.0 and is open to contributions from the community.