Fabric Verify

What Fabric Verify does

Fabric Verify creates tamper-evident records for agent activity and submits them to the Fabric Verify public log. The local package signs each record with a key held on the machine, then returns a log index that can be used to retrieve a proof later.

The service preserves record text locally. The public log receives a salted fingerprint, the action kind, a timestamp, and coded identifiers that can be linked to an agent by the agent owner or an auditor with an audit pack. Records are permanent. Agent names, key names, and public keys are kept in an erasable store, so personal information should not be placed in FABRIC_AGENT or FABRIC_KID.

A proof establishes that one exact record was logged without alteration by a particular time. It does not establish that the event described by the record actually happened or that a reported tool result is true.

How it works

The package runs as a local stdio MCP process. record_action signs and submits a concise action record; record_event handles structured events such as tool calls, results, approvals, delegations, policy decisions, and halts. Events can refer to earlier records through returned record identifiers and fields such as run_id, step_id, parent_record, and delegation_record.

Record text, salts, keys, and fetched proofs are stored beneath FABRIC_HOME, which defaults to ~/.fabric-verify. If a recording call fails, repeating it with the same idempotency key, kind, and summary resends the same signed record and avoids charging it more than once.

get_proof retrieves a proof, optionally waiting up to 45 seconds. Proofs are commonly available a few minutes after recording. export_events collects selected events and their proofs into a file for offline checking with the augmentev-verify utility.

Setup and configuration

Node.js 20 or later is required. Configure an MCP client to run npx -y @augmentev/fabric-verify-mcp, and provide a prepaid FABRIC_CREDIT_KEY plus a stable, printable-ASCII FABRIC_AGENT value. Claude Code can add the server with claude mcp add and equivalent environment options.

Optional settings select the signing-key name, local storage directory, and per-session spending ceiling:

• FABRIC_KID defaults to <agent>-key-1; change it when rotating keys.
• FABRIC_HOME defaults to ~/.fabric-verify.
• FABRIC_MAX_SPEND_USD defaults to 1.

Back up FABRIC_HOME/agent-ed25519.pem. If that key is lost, use a new FABRIC_KID.

The remote connector at https://mcp.augmentev.com/mcp requires no local package installation. A sign-in flow accepts the credit key, assistant name, and daily limit, then gives the client an access token. Remote records use an AugmentEV-hosted signing key rather than a key held by the agent.

Tools and capabilities

• record_action logs a signed action with a kind, summary, optional idempotency key, and optional approval record. Each record costs $0.005 from prepaid credit.
• record_event logs structured agent events at the same price and supports links between related actions, approvals, delegations, runs, and steps.
• export_events creates a proof-bearing event bundle and is free.
• get_proof fetches and stores an individual proof at no cost.
• check_balance reports remaining credit and spending for the session.
• buy_credit_link creates a card checkout link for $25, $50, $100, or $500 without charging through the tool.

Download the verifier and published log keys from augmentev.com/verify, then run augmentev-verify log-proof proof.json --pins fabric-log-v1.json --audit agent-record.json in the record directory.

Limitations and notes

The local package requires prepaid credit for recording calls. The remote connector exposes only record_action, record_event, get_proof, and check_balance, and its records are labelled augmentev-hosted.

An exported bundle proves that included events were logged unchanged and that links point to earlier events of the expected type. It does not prove that the bundle contains every event, nor that a described tool result is correct. Events created on different machines must be merged in log order for combined checking.

For production use, pin an exact package version and update it deliberately. Keep the agent key available for future verification and audit work.