Agent Custody

What agent-custody does

The agent-custody MCP server places a gateway between an agent and the tools it can invoke. The gateway evaluates each call against a signed delegation grant and Cedar policy, then either forwards or denies it. Denied calls still produce receipts. For tools configured for precommit, it records the authorization before forwarding and withholds the call if that record cannot be added.

The system supports MCP servers, REST APIs represented as tools, and other agents reached through A2A. The Python package provides sidecar operations named decide, record, and wrap, with adapters for several agent frameworks. The receipts package also includes an in-process SDK, framework adapters, a gateway, a transparency log, and offline verification.

How it works

A principal signs a delegation grant containing the agent identity, permitted tools, and validity period. The gateway makes policy decisions using facts it retrieves itself rather than relying on claims supplied by the agent. Each call becomes a signed receipt describing authorization, the agent's observed inputs, its action, and downstream dependencies.

Receipts are appended to a local Merkle transparency log and include inclusion evidence. A remote log can be configured when records must be reviewable by an auditor, customer, regulator, or other party that does not trust the operator of the local log. The remote log signs tree heads with its own key.

Verification can be performed with the verify and audit commands or verifyBundle. These checks require public keys, not access to the system that generated the receipt. The SDK interceptor can record calls inside an agent process, but those records remain self-reported; only calls routed through the gateway receive the gateway's enforcement boundary.

Setup and configuration

Use the SDK interceptor for agents that call tools, then add the gateway when calls have consequential effects or require externally verifiable authorization. Configure the gateway with a signed delegation grant, Cedar policy, and the tools or endpoints it should mediate. A log configuration selects remote logging when local custody is insufficient.

The Python distribution is the client for the sidecar and includes adapters for LangChain, the OpenAI Agents SDK, the Claude Agent SDK, CrewAI, Google ADK, and Hermes Agent. Go, Java, and Rust clients are available in the repository's language examples. The receipts package includes runnable tutorials, while the state package can use JSONL or SQLite for its ledger and can expose memory behind the gateway or over HTTP.

Tools and capabilities

• Evaluate calls with signed grants and Cedar policy.
• Record signed receipts for allowed and denied calls.
• Add receipts to a Merkle transparency log and verify inclusion.
• Verify or audit receipt bundles using public keys.
• Track governed memory in a ledger where facts cite their source receipts.
• Mark facts as superseded or retracted instead of overwriting or deleting them.
• Trace forward dependencies and blast radius after a questionable write.
• Apply quarantine and provenance levels to memory writes.
• Support retention, legal holds, certified forget, and signed evidence packs.
• Write through to Mem0 and Zep while retaining custody metadata.

Limitations and notes

The agent-custody MCP server covers only calls that pass through its gateway. A credential available directly in the agent's environment can bypass that boundary. In-process SDK records are explicitly self-reported and should not be treated as equivalent to gateway enforcement.

Remote logging addresses trust in the operator of the local log, but it requires configuring the remote log. The memory package does not cover caches, model context, backups, or warehouses when performing forget operations. Its certified deletion process applies to the ledger and adapted stores and records how each store responded.

The system is intended for the Security category when an agent's authorization, actions, observations, or derived memory must be independently checked. The gateway and receipt components can be used without enabling every state and memory feature.