Signet

Don't just log agent actions. Prove them.
_{Cryptographic trust and authorization evidence for every AI agent action — identity, delegation, policy, receipts: signed, hash-chained, offline-verifiable. Independent of any provider.}

_{TypeScript packages: @signet-auth/core · @signet-auth/mcp · @signet-auth/mcp-server · @signet-auth/mcp-tools · @signet-auth/node · @signet-auth/vercel-ai}

▶ Try the live demo — sign a tool call in your browser, change a field, and watch verification fail. _{(mirror: GitHub Pages)}

_{▶ Walkthrough: signing, audit log, and verification · ▶ Demo: execution boundary & MCP integration}

_{Single-host pilot flow: sign every tool call, hand off a signed evidence bundle, re-verify on any machine — no signet keystore required. Pilot runbook →}

Your AI agent just placed an order, deleted a row, sent an email, merged a PR. Can you prove exactly what it did — to an auditor, a customer, or yourself after an incident?

Signet is the independent trust layer for agent actions. Every tool call gets a signed receipt that anyone can verify offline, without trusting the platform that hosted the agent or the vendor that stored the logs — and since 0.11, the authorization behind an action carries its own proof: who the agent is (principal), who let it act (delegation), and who allowed this specific action (authority-signed decision).

Your agents run on their infrastructure. The proof belongs to you.

Why Not Just Logs?

Traditional logs tell you what a platform says happened. They're mutable, provider-dependent, and unverifiable without trusting the party that wrote them.

Signet receipts are different. Modify any field — tool name, parameters, timestamp, signer — and the Ed25519 signature breaks. Delete or reorder entries and the SHA-256 hash chain breaks. Verification requires only the public key. No network call, no API, no login.

Use logs for observability. Use Signet when you need evidence.

Who Is This For?

• MCP builders — wrap any MCP server with signet proxy, sign every tools/call, no code changes
• Security / compliance teams — tamper-evident audit trail that satisfies EU AI Act Art. 12, SOC 2 CC7.2, ISO 27001 A.8.15
• Enterprise agent platforms — prove what the agent did, who authorized it, which policy was in force
• Framework users — LangChain, CrewAI, Claude Code, Codex, OpenAI Agents, Vercel AI SDK — all supported
• Agent-to-agent deployments — bilateral co-signing when both sides hold keys

If a tool call cannot be verified independently, it should not be trusted unconditionally. This matters when an auditor asks for proof, when an incident happens on infrastructure you don't control, or when the question isn't "what does the console say" but "what actually happened."

Each agent gets an Ed25519 identity. Every tool call can be signed, appended to a hash-chained audit trail, verified offline or before execution, co-signed by the server, bound to a delegation chain, and optionally bound to a policy decision.

The video above shows the full flow. The SVG below shows the CLI signing details, or jump to See It Reject Bad Requests to watch the server block bad requests before they run.

_{This first demo shows signing + audit receipts. See also the MCP flow diagram.}

What Signet Adds

Signet adds a lightweight trust layer for agent actions:

• Sign every tool call with the agent's cryptographic key
• Verify requests offline or at the execution boundary before they are trusted
• Proxy any MCP server transparently — sign requests without touching agent or server code, with local bilateral audit co-signing in the proxy path
• Co-sign server responses with bilateral receipts when you control both sides
• Trace multi-step workflows by linking receipts with trace_id and parent_receipt_id
• Authorize agents with scoped delegation chains that prove who allowed the action
• Attest policy by embedding a signed PolicyAttestation when a YAML policy is satisfied
• Inspect locally with an append-only audit log and dashboard, no hosted control plane required

What's New In 0.11

• Canonical principals: every identity can carry a scoped principal URI (agent://prismer/deploy-bot), signed inside receipts and delegation tokens; acting_for claims are machine-corroborated by the chain root.
• Authority-signed authorization decisions: signet authorize pre-approves one intent; signet sign --decision produces a receipt backed by it (or --authority-key does it in one step). A decision binds to the action via intent_hash, so replay onto a different action is refused.
• Revocation: signet revoke invalidates delegation tokens and decisions with an issuer-signed record. Verification reports an explicit status — revoked fails, unknown is never reported as authorized (--require-revocation-known for strict mode). Evidence bundles carry revocation records.
• Conditions and limits: policy rules carry typed obligations (require_approval, sandbox, …); delegation scopes carry constraints (--max-calls, --spend-limit). Sign paths enforce call-count budgets and the narrowing invariant (a grant can shrink a delegation, never widen it).
• Hardening: verify() now correctly verifies v4 receipts; rate-limited policy rules fail closed when no state is supplied; delegation expiry binds to wall clock (backdating a receipt timestamp no longer dodges it).

Compliance

Signet provides the technical controls that auditors look for when assessing AI agent operations. See the full Compliance Mapping for details.