A new paper introducing something called AIP (Agent Identity Protocol) opens with a blunt diagnostic: AI agents increasingly call tools via the Model Context Protocol and delegate to other agents via Agent-to-Agent, yet neither protocol verifies agent identity. The authors backed that claim with an actual scan of roughly 2,000 MCP servers and found that all of them lacked authentication. That's not a hypothetical gap — it's the current state of the most widely adopted agent tool-calling standard. The paper's proposed fix is a primitive called Invocation-Bound Capability Tokens (IBCTs), which fuse three things into a single append-only chain: identity, attenuated authorization, and provenance binding. The idea is that every hop in a multi-agent delegation chain — agent A calling agent B calling a tool server — carries a token that proves who's acting, what narrower slice of authority they've been handed, and a record of what happened at each step. What's notable is the wire-format pragmatism. IBCTs come in two modes: a compact mode using a plain signed JWT for single-hop cases, and a chained mode using a Biscuit token with Datalog policies for multi-hop delegation. That split matters because most agent auth proposals pick one format and hope it scales; this one explicitly separates the simple case (one agent calling one tool) from the hard case (a chain of delegations across MCP, A2A, and plain HTTP), where attenuation — each hop narrowing what the next hop is allowed to do — has to be enforceable, not just claimed. The authors also say they surveyed prior work and found no existing implemented protocol that jointly combines public-key verifiable delegation, holder-side attenuation, expressive chained policy, and provenance-oriented completion records — meaning the pieces have existed separately (JWTs solve identity, capability tokens solve attenuation, audit logs solve provenance) but nothing wired them together into one token chain that works across both MCP and A2A. The reference implementations are in Python and Rust with cross-language interoperability, which suggests this is meant to be tested against real MCP servers, not just simulated. Given that the same team's own scan found zero authenticated servers in the wild, the gap between "here's a spec" and "here's what's actually deployed" is still wide. But the scan itself is the more consequential finding: it quantifies, for the first time in public research, just how unauthenticated the current MCP ecosystem is at scale.