[Feature Request]: Add Creduent zero-trust agent identity verification plugin for ADK

[cyberfascinate]

** Please make sure you read the contribution guide and file the issues in the right place. **
Contribution guide.

🔴 Required Information

Is your feature request related to a specific problem?

When ADK workflows delegate tasks to sub-agents, agents lack a standard mechanism to verify if a target agent URI (agent://<namespace>/<name>) is cryptographically signed before executing tasks. This allows untrusted agent calls and unverified prompt injections to compromise multi-agent execution loops.

Describe the Solution You'd Like

Introduce CreduentGoogleADKPlugin — a local Ed25519 + JCS RFC 8785 cryptographic verification plugin for agent URIs in under 5ms, with no network calls required.

Impact on your work

Critical for securing enterprise multi-agent delegation chains. Implementation and test suite are ready to submit as a Pull Request.

Willingness to contribute

Yes

---

🟡 Recommended Information

Describe Alternatives You've Considered

1. Manual HTTP verification before sub-agent calls — adds latency.
2. Custom wrapper functions — no standard schema validation across frameworks.

Proposed API / Implementation

from creduent.integrations.google_adk import CreduentGoogleADKPlugin

plugin = CreduentGoogleADKPlugin(
    agent_uri="agent://assistant.dev/agent",
    timeout=10
)

Additional Context

• Python SDK: pip install creduent / pip install google-adk
• Open-Source Protocol: https://github.com/idevsec/creduent

[sanketpatil06]

Hi @cyberfascinate , Thanks for your feature request. the request is currently being reviewed, and we will let you know if anything further is needed. Thank you for your understanding.

[cyberfascinate]

Hi @sanketpatil06 , thank you for self-assigning and reviewing the request!

The plugin implementation (CreduentGoogleADKPlugin) and corresponding unit tests are ready. Whenever you'd like to take a look, I'd be happy to open a Pull Request.

Google CLA is signed (cyberfascinate@gmail.com).

Looking forward to your feedback.

[Astro-Saurav]

This makes sense to me.

One of the biggest gaps in multi-agent systems today is that we often trust an agent:// reference without verifying who actually owns it. A built-in verification step before delegation would give developers a consistent security model instead of everyone writing their own wrapper.

The proposed local Ed25519 + JCS approach also keeps the verification path fast and avoids network dependencies, which is important for agent-to-agent execution.

Interested to see the PR and how this fits into the existing ADK plugin architecture.