HOL Standards SDK

Implement HCS standards, agent discovery, and trustless communication in your applications.

Stars
★ 1.2k
Last updated
2d ago
License
Apache-2.0
Primary language
TypeScript

At a glance

How it runs
Library / SDKCLIFramework
Works with
Platform-specific
Setup effort
Medium · a few setup steps
You'll need
npm or pnpmHedera credentials for Hedera demosA fetch implementation for core agent search and chat flowsShell / CLINetwork accessLocal filesystem
Typical use
Hedera developers implementing HCS-1, HCS-2, HCS-3, HCS-7, HCS-10, HCS-11, HCS-20, or HCS-27 in a TypeScript application.
Not a fit if
  • Teams seeking a general protocol stack outside the Hedera/HCS ecosystem
  • Users looking for a ready-made chatbot
  • Teams requiring documented compatibility with a specific model platform

What does this agent do, and when should you use it?

HOL Standards SDK is a lightweight, HOL-maintained development kit containing reference implementations of Hashgraph Consensus Standards. It is distributed as the full `@hol-org/standards-sdk` package and the smaller `@hol-org/rb-client`, with an interactive CLI and runnable demonstrations. Its documented scope covers file storage, registries and indexing, recursive file loading, Smart Hashinals, agent communication, decentralized identity, auditable points, and transparency logs. Applications can use `RegistryBrokerClient` for agent search and chat, skill lifecycle queries, skill domain proofs, and UAID DNS TXT verification, while the HCS-10 demos exercise agent creation, registration, connection, and messaging. The SDK runs inside the adopter's JavaScript or TypeScript application; network transports, Hedera credentials, Registry Broker endpoints, and optional payment or ledger-authentication packages remain deployment responsibilities.

An application imports RegistryBrokerClient and connects to a Registry Broker using an API key or baseUrl. The client can call requestSkillVerification for a named skill version, obtain a DNS TXT challenge through createSkillDomainProofChallenge, and submit it through verifySkillDomainProof; getSkillStatus returns the trust tier, next steps, and any preview status URL. For HCS-14 UAID profiles, verifyUaidDnsTxt checks and can persist an _uaid.<nativeId> TXT proof, while getVerificationDnsStatus reads or refreshes its status. The HCS-10 demo creates and registers Alice and Bob, connects them, exchanges small messages, and handles larger messages using recursive storage; creation state can be written to .env for resumption after interruption. Separate inscription examples handle text, URLs, and file buffers and create Hashinal NFTs from URLs, buffers, or text. The pnpm run cli launcher exposes Registry Broker, OpenRouter, chat-history, ledger-authentication, and HCS-10 demonstrations.

  1. Hedera developers implementing HCS-1, HCS-2, HCS-3, HCS-7, HCS-10, HCS-11, HCS-20, or HCS-27 in a TypeScript application.
  2. Agent-platform teams that need Registry Broker discovery, chat, and lifecycle or trust-status checks for versioned skills.
  3. Skill publishers requesting verification for a specific release and proving control of its domain through DNS TXT.
  4. Decentralized-identity developers validating and persisting _uaid.<nativeId> DNS proofs for HCS-14 UAIDs.
  5. Prototype teams demonstrating registration, connection, message exchange, and interrupted-creation recovery between two HCS-10 agents.
  6. Applications that need only Registry Broker functionality and prefer a smaller client without bundled network transports.

How do you install or deploy this agent?

Install the full SDK under the current HOL scope:

npm install @hol-org/standards-sdk

The documented legacy scope remains available:

npm install @hashgraphonline/standards-sdk

For Registry Broker functionality alone, install the smaller client:

npm install @hol-org/rb-client

@hol-org/rb-client bundles no network transports. Core agent search and chat require a fetch implementation. X402 purchases and payments require axios, x402-axios, and x402; EVM ledger authentication requires viem; Hedera ledger authentication requires @hashgraph/sdk.

To run repository demos, clone the project and install its dependencies:

git clone https://github.com/hashgraph-online/standards-sdk.git
cd standards-sdk
npm install

Create the environment file:

cp .env.example .env

Populate the demonstrated settings:

HEDERA_ACCOUNT_ID=0.0.12345
HEDERA_PRIVATE_KEY=your_private_key_here
HEDERA_NETWORK=testnet
REGISTRY_URL=https://moonscape.tech

The supplied material does not specify a Node.js version.

How do you use this agent?

Start with the interactive launcher to inspect demos, required environment variables, and helper scripts:

pnpm run cli

Run the Registry Broker or HCS-10 demos directly:

npm run demo:registry-broker
npm run demo:hcs-10

A minimal skill-lifecycle lookup uses RegistryBrokerClient as follows:

import { RegistryBrokerClient } from '@hashgraphonline/standards-sdk';

const client = new RegistryBrokerClient({
  baseUrl: 'https://hol.org/registry/api/v1',
});

const status = await client.getSkillStatus({
  name: 'registry-broker',
  version: '1.0.0',
});

console.log(status.trustTier);
console.log(status.nextSteps);
console.log(status.preview?.statusUrl ?? null);

The corresponding runnable demo is:

pnpm -C standards-sdk run demo:registry-broker-skill-status -- --skill-name=<name> --skill-version=<version> --base-url=<broker-api-url>

For skill-domain verification, configure REGISTRY_BROKER_API_KEY, request a challenge, publish its TXT value, and submit the token:

import { RegistryBrokerClient } from '@hashgraphonline/standards-sdk';

const client = new RegistryBrokerClient({
  apiKey: process.env.REGISTRY_BROKER_API_KEY,
});

await client.requestSkillVerification({
  name: 'demo-skill',
  version: '1.0.0',
  tier: 'basic',
});

const challenge = await client.createSkillDomainProofChallenge({
  name: 'demo-skill',
  version: '1.0.0',
  domain: 'example.com',
});

const challengeToken = challenge.txtRecordValue.replace(/^hol-skill-verification=/, '');

await client.verifySkillDomainProof({
  name: 'demo-skill',
  version: '1.0.0',
  domain: 'example.com',
  challengeToken,
});

What are this agent's strengths and limitations?

Pros
  • One SDK covers eight explicitly listed HCS standards and supplies concrete HCS-10 communication and Registry Broker reference flows.
  • Teams can choose the full SDK or the smaller, transport-free @hol-org/rb-client to control integration scope and dependencies.
  • Skill verification combines name-and-version lifecycle status with DNS TXT domain proof, while UAIDs have a separate HCS-14 DNS verification API.
  • The HCS-10 demo records agent-creation progress in real time and can resume after an interruption.
  • The interactive CLI consolidates demonstrations, environment requirements, documentation links, and directly runnable scripts.
Limitations
  • The standards and advanced workflows center on the Hedera/HCS ecosystem, so projects using other ledgers or protocols need adaptation.
  • Full demos require a Hedera account, private key, network, and Registry URL rather than only a package-install command.
  • @hol-org/rb-client includes no network transport, and payment or ledger authentication introduces several optional dependency sets.
  • The source does not state a supported Node.js version or document native ChatGPT, Codex, Claude, or model-API compatibility.
  • Costs for Registry Broker access, Hedera transactions, agent funding, and X402 payments are not documented.

How does this agent compare with similar options?

Compared with the complete @hol-org/standards-sdk, @hol-org/rb-client contains only the Registry Broker client, has a smaller footprint, and bundles no network transports. Choose the full package for HCS implementations, HCS-10 flows, and the broader demos; choose the client when an application only needs discovery, chat, or Registry Broker integration and can add fetch, X402, EVM, or Hedera authentication dependencies as required.

Key facts side by side with the most closely related agents.

Agent Source review Form / cost Stars Updated Language Full support on
HOL Standards SDK This agent 59 · Major gaps Library / SDK ★ 1.2k 2d ago TypeScript —
TrueForge 67 · Some gaps CLIFree + model costs ★ 6k 1d ago TypeScript OpenAI API · Claude API
AgentOS 52 · Major gaps Library / SDKFree + model costs ★ 672 8d ago TypeScript Claude Code · OpenAI API · Claude API
PenguinHarness 52 · Major gaps Desktop appFree + model costs ★ 2.4k 3d ago TypeScript OpenAI API · Claude API

How does FollowAgents rate this agent?

FollowAgents source review · FARS-2.1
Major gaps
59/ 100 5-point scale 3.0 / 5
Trust 14/29
Reliability 6/14
Adaptability 14/18
Convention 12/18
Effectiveness 9/13
Verifiability 4/8
Why each dimension lost points
Trust14 / 29 · 2.4/5

The README openly describes registry operations, DNS verification, payments, ledger authentication, messaging, topic creation, and automatic funding, and it recommends environment variables for private keys. SECURITY.md advises least privilege, dependency auditing, and key protection, while dependency overrides show some active remediation intent. Deductions apply because these are mostly documentation-level controls: no permission enforcement, pre-transaction confirmation mechanism, key-storage control, or audit artifact is shown. Demos can modify .env and perform ledger-side effects. Resumable setup offers limited recovery, but no reversal path is documented for registration, payment, or minting. Authorship, issue channels, and a maintainer-file reference provide attribution, although the maintainer contents are absent and publisher identity remains unverified.

Reliability6 / 14 · 2.1/5

Installation, build, test, and numerous demo commands form a substantial usage path, while a fixed pnpm release, dependency ranges, overrides, and optional-peer guidance support dependency availability. Deductions reflect internal drift: SECURITY.md supports only 0.0.43 while package.json identifies 0.1.158-canary.0; the README's supported-standard list is narrower than the demo scripts; and old and new package scopes are mixed. The CLI is said to expose required variables and persist interrupted state, but the supplied evidence contains no implementation-level error handling or systematic failure-message examples.

Adaptability14 / 18 · 3.9/5

The material clearly targets Hedera/Hashgraph decentralized-application and AI-agent developers and covers discovery, chat, identity, DNS, payment, registration, and communication scenarios. A full SDK, smaller Registry Broker client, optional transports, and browser/ESM/CJS outputs support adaptation. Deductions apply because the broad capability surface lacks a consolidated permission or support matrix, invocation precision is mostly left to explicit developer calls and script selection without runtime policy controls, and supported Node, browser, and network versions are not comprehensively specified.

Convention12 / 18 · 3.3/5

The README structures quick start, documentation, standards, CLI, demos, security, contribution, and maintenance entry points. Installation and environment setup are concrete, and numerous runnable examples support ordinary use. Apache-2.0 metadata matches the complete LICENSE, justifying full license credit. Deductions reflect simultaneous old/new npm scopes and HOL/Hashgraph Online naming, no supplied changelog, a supported-version mismatch, and no consolidated known-limitations section. Contact, issue, security, and MAINTAINERS.md routes identify responsibility, but the actual maintainer list and release governance are not included.

Effectiveness9 / 13 · 3.5/5

Type declarations, multiple build targets, a CLI, scenario-specific demos, and granular scripts make the outputs readily usable. A unified implementation of multiple HCS standards plus a smaller Registry Broker distribution offers meaningful incremental value. Deductions apply because claims such as “lightweight” and “complete implementation” lack size, performance, or coverage evidence. The full package has a large dependency surface, and some flows require network services, credentials, ledger fees, or extra transports, without quantified costs, spending limits, or resource trade-offs.

Verifiability4 / 8 · 2.5/5

The README connects major capabilities to named APIs, scripts, environment variables, and documentation entry points, while package exports, dependencies, and scripts corroborate several claims. License identification agrees across README, package.json, and LICENSE. Deductions apply because implementation sources, test contents, release records, and audit reports are absent, preventing detailed traceability. Version, scope, and supported-standard inconsistencies weaken corroboration, and assertions such as “official,” “lightweight,” “complete implementation,” and regular security audits are not clearly separated from demonstrated facts.

Risks and how to mitigate them
  • Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
  • Demos may automatically fund accounts, create topics, register agents, submit transactions, purchase credits, or mint assets. Verify targets, fees, and credentials on a test network and add explicit confirmation to every costly or irreversible step.
  • Do not commit private keys or persisted agent state. The README says the CLI may write state to .env, but the supplied material shows no file-permission, encryption, or redaction controls.
  • Confirm the actual release and support policy before adoption: SECURITY.md lists 0.0.43 while package.json identifies 0.1.158-canary.0, and old and new npm scopes coexist.
  • Dependency overrides show attention to several affected version ranges, but they are not an independent security audit; scan the lockfile and resolved dependency tree separately.
Evidence confidence: Low Reviewed Sep 25, 2026 Reviewed revision 5f6c5ff4ffc2
See the full review method →

FAQ

Does core search and chat require the Hedera SDK?
No. Core agent search and chat in @hol-org/rb-client require only a fetch implementation; @hashgraph/sdk is needed specifically for Hedera ledger authentication.
What access is needed for skill-domain verification?
The example uses REGISTRY_BROKER_API_KEY to request verification and requires publishing the challenge as a DNS TXT record, so both Broker credentials and DNS control are needed.
Must an interrupted HCS-10 agent creation start over?
The demo records creation progress in .env, and the documented flow resumes from the saved point after interruption.
Are payment and ledger transports included?
No. The smaller client bundles no network transports; X402, EVM, and Hedera authentication each require additional packages.
What does it cost to operate?
The code is Apache-2.0 licensed, but the source gives no pricing for Registry Broker access, Hedera transactions, agent funding, or X402 payments.
View on GitHub ↗ Install ↓

Compare agents like this one

The same FARS review applied across the shortlist this agent qualifies for.

Related agents