PEAC Protocol

What PEAC Protocol does

PEAC Protocol provides MCP tools for handling PEAC receipts and signed records. Its supported operations include verifying a record, inspecting its contents, decoding its representation, issuing a new record, and assembling records into a portable bundle.

PEAC records are signed statements about interactions or challenges. They can describe API calls, MCP tool runs, agent actions, gateway decisions, payment events, and provisioning events. A record may preserve issuer-reported facts, policy or context bindings, a result, issuance and event times, issuer identity, and a verifiable signature.

The server is suited to agents that need to work with interaction evidence rather than perform the interaction itself. Bundled records can support audit review, dispute review, compliance workflows, incident reports, or movement across system boundaries.

How it works

An issuing system observes or reports an interaction and creates a signed PEAC record. The record includes required Wire 0.2 claims such as the PEAC version, record kind and type, issuer, issuance time, and unique identifier. Its protected JWS header includes signing and type-discrimination parameters, including the algorithm, key identifier, and type.

A receiving system can then verify the signature and record structure with the issuer's public key. Verification can take place locally or through a self-hosted verifier, without depending on a remote verification service. The resulting record or bundle can be passed to another workflow or system boundary.

PEAC records describe what the issuer reported; they are not independently established facts. The issuer may be the system that performed the work, an observer, gateway, adapter, or runtime.

Tools and capabilities

• Verify PEAC records and receipts against an issuer's public key.
• Inspect record contents and structure.
• Decode PEAC record representations for examination or downstream handling.
• Issue signed PEAC records for reported interactions or challenges.
• Bundle records into portable evidence packages.
• Handle evidence associated with APIs, MCP tools, agents, gateways, payments, and provisioning events.

Limitations and notes

PEAC does not authorize actions, validate credentials, process payments, settle transactions, operate agents, assign trust scores, or replace observability systems. A record represents an issuer's claim about an interaction, so consumers still need to evaluate any linked payment, timestamp, transparency, or other external proof under its own verification rules and trust model.

The protocol does not turn an interaction record into proof of an independently verified fact. Policy, event time, actor information, representations, pillars, and extensions are optional or dependent on the applicable profile. Portable bundles support review and transfer, but their contents remain subject to the issuer and verification context.

PEAC is open-source software maintained by Originary and distributed under the Apache-2.0 license.