Internet Identity is getting an MCP server. We sat down with Arshavir Ter-Gabrielyan to understand what it is and why it matters. He starts with the problem: an AI agent runs in a cloud sandbox. No access to your device. No safe way to hold your keys. The MCP... server is the answer. Keys stay in a trusted execution environment, and the agent asks permission to act in each app. Full conversation below.show more

Full interview with Arshavir Ter-Gabrielyan:

Full interview with Arshavir Ter-Gabrielyan:

Good work! This is really useful. I hope you integrate Proof of Personhood into Internet Identity soon, optionally, of course, but in a way that dApps can leverage.

Storing credentials in a cloud sandbox is a security nightmare.

Don’t give up guys

The real constraint isn't just key management — it's establishing trust boundaries between autonomous processes and human-controlled assets. Most agent infra treats identity as a login problem when it's actually a delegation architecture problem. An agent needs to know which operations are reversible, which require explicit consent, and which should never execute without human sign-off. That's not authentication — it's policy enforcement at the workflow level. The interesting question: will this become another point solution you authorize once per session, or will it genuinely learn your permission patterns over time? The former solves today's demo. The latter compounds into actual production readiness.

速来口我🤓

Massiv 🫪

'trusted execution environment' is doing a lot of heavy lifting there who decides whats trusted

Permission to act is only the first gate. The harder part is what happens after: what the agent is forbidden to do, who decides when policy changes, and what evidence you keep. MCP identity without runtime governance still leaves you guessing. Design the rules into the build — @clawmaven

A 0,icp ha sido un fracaso y una desilusión absoluta

Internet Identity MCP server menang di trust, tapi kuncinya per-action permission, bukan full session. Agent boleh act, tapi blast radius tetap mini.

本当貴方たちは一生議論してるだけで、世の中の人々に1mmも役になってないな

The key question now isn't whether ICP has MCP support, it's whether developers build compelling MCP-enabled applications on ICP and whether AI clients can actually use them at scale.

curious how the permission prompt actually feels in practice like does the user see one approve-all or a per-action dialog, bc thats where most of these fall apart

the real challenge is how to balance between "yolo" and "everything needs to be approved" we like fine-grained mcp tool permissions and user supervision but when you try to move to sandboxes how do you maintain the permissions boundary? we do it by tying to a real responsible user but not sure that's the long-term play... what do others find works?

Exhibit DFINITY, case closed 🚀

Identity solves "which agent is this." The harder half is "what is it allowed to do right now." Scoped actions per tool call, plus an auditable record of what ran with what inputs — that's the part of the boundary that makes agent access operable.