8 tools
Identity
Unified Agent Identity Tokens (UAIT) bridging MCP OAuth, A2A, DIDs and API keys. local data erasure tooling.
create_agent_identityverify_identitytranslate_identity+5
Platform
One evidence layer for every AI agent
Framework agents, MCP clients, coding agents, and the agents you build yourself all write to the same signed, hash-chained record, which anyone can verify offline with open-source tools.
How it works
Capture, sign and chain, verify anywhere
1. Capture
Framework callbacks, MCP tool calls, the Python API, the REST API, or Pro coding-agent capture record what each agent did.
2. Sign and chain
Each record is signed with Ed25519 and hash-chained to the one before it, so an edited, removed, or reordered record breaks the chain.
3. Verify anywhere
Export a bundle and check it offline with the verifier SDKs, the CLI, or the browser verifier, without calling Attestix.
Attestix Cloud (in development) does not establish independent witnessing. A separately trusted checkpoint or witness is needed to reduce reliance on one operator’s key.
Where Attestix runs
Wherever your agents already are
Agent frameworks
Shipped helpers in the package: AttestixCallback for LangChain, AttestixAuditHook for the OpenAI Agents SDK, and AttestixCrewAdapter for CrewAI.
Integration guideAny MCP client
A stdio MCP server exposes the documented tools to any client that can launch one. Example scripts for more frameworks live in the repository.
MCP tool referenceCoding agents
Attestix Pro captures Claude Code sessions today. Cursor, Codex CLI, GitHub Copilot, Gemini, and other coding agents are on the roadmap.
Coding-agent captureYour own agents
Call the Python API directly, or run the REST API (the api extra) and send records from any language over HTTP.
API referenceNine modules. Forty-seven tools.
Attestix exposes the full compliance surface as MCP tools, REST endpoints and a Python library. Each module is independently testable and self-contained, and builds on W3C DID and Verifiable Credential data models, IETF RFCs, and UCAN-style delegation.
3 tools
Agent Cards
Parse, generate and discover A2A-compatible agent cards via /.well-known/agent.json.
parse_agent_cardgenerate_agent_carddiscover_agent
3 tools
DID
Create and resolve W3C Decentralized Identifiers (did:key, did:web) with Ed25519VerificationKey2020.
create_did_keycreate_did_webresolve_did
4 tools
Delegation
UCAN-style delegation tokens: server-signed EdDSA JWTs with attenuation checks and revocation.
create_delegationverify_delegationlist_delegationsrevoke_delegation
3 tools
Reputation
Recency-weighted trust scoring (0.0 to 1.0) with category breakdown and search.
record_interactionget_reputationquery_reputation
7 tools
Compliance
EU AI Act risk profiles, conformity assessment records (Article 43), signed Annex V declarations with auto-issued credentials.
create_compliance_profilerecord_conformity_assessmentgenerate_declaration_of_conformity+4
8 tools
Credentials
Credentials and presentations in the W3C VC data model, with Ed25519 proofs over Attestix canonical JSON, checked by the Attestix verifiers.
issue_credentialverify_credentialcreate_verifiable_presentation+5
5 tools
Provenance
Training data provenance (Article 10), model lineage (Article 11), hash-chained audit trail (Article 12).
record_training_datarecord_model_lineagelog_action+2
6 tools
Blockchain
Anchor artifact hashes to Base L2 (Sepolia testnet by default) via the Ethereum Attestation Service, with Merkle batching for audit logs.
anchor_identityanchor_credentialanchor_audit_batch+3
Editions
Open source, Pro, and Cloud
The open-source core is the evidence format and the tools. Pro adds capture for coding agents. Cloud will host and witness the record for you.
| Feature | Open source | Attestix Pro | Attestix Cloud |
|---|---|---|---|
| Status | Available (v0.4.3) | Early access | In development |
| License | Apache 2.0 | Commercial | Commercial |
| Agent identity, credentials, delegation | Included | Included | Included |
| Hash-chained, signed audit trail | Included | Included | Included |
| EU AI Act records and export bundle | Included | Included | Included |
| Framework integrations, MCP server, CLI, Python API | Included | Included | Included |
| Instrumented coding-agent capture | Not included | Included | Planned |
| Policy enforcement that blocks and records | Not included | Included | Planned |
| Hosted ingest and dashboard | Not included | Not included | Planned |
| Per-tenant signing keys in a KMS | Not included | Not included | Planned |
| Independent witnessing (RFC 3161, transparency log) | Not included | Not included | Planned |
| Retention of at least six months | Not included | Not included | Planned |
Coding-agent capture (Attestix Pro, early access)
A verifiable record of every coding-agent session
Pro captures Claude Code today, across all of its hook events. It cross-checks them against local OpenTelemetry and the session transcript, so any event the hooks missed shows up as a gap instead of silently disappearing.
- Per-session launcher; no permanent configuration changes.
- Optional policy enforcement that blocks a tool and records the denial.
- Local integrity checks do not establish complete capture or independent witnessing. Validate your selected operating environment.
- Cursor, Codex CLI, GitHub Copilot, Gemini, and other coding agents are on the roadmap.
# record one Claude Code session
$ attestix-pro run -- claude
# check the chain afterwards
$ attestix-pro verify
What it detects
- Edited record
- Hash checks detect changes against a trusted reference. Key holders can rewrite records.
- Deleted record
- Interior deletion breaks linkage unless the chain is recomputed.
- Truncated log
- A trusted final checkpoint and expected count are needed to detect truncation.
- Blocked action
- Denial records require correctly configured instrumentation and an accepted operating path.
Honest limits
What the evidence proves, and what it does not
It proves
- The records were not changed by anyone without the signing key.
- The stated identity and ordering recorded by the signing instance.
- Which instrumented events were observed. Unobserved activity and complete capture require separate validation.
It does not
- Records are signed by your Attestix instance; whoever holds that key could rewrite them today. Independent witnessing requires separate implementation and acceptance.
- It is not a compliance certification. It is evidence for an assessment, not the assessment.
- Live revocation checks still need the issuer.
Start with the open-source core
Install it in a minute, or talk to us about coding-agent capture and hosted evidence.