Audifact

io.audifactPublished by audifact.ioOfficial publisherv0.1.1Updated Nov 2, 2026

Signed, append-only receipts of an AI agent's decisions and outcomes, with public proof links.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringAI & ML

Overview

AI-generated overview

Audifact gives an AI assistant a hosted, append-only ledger to log signed decision and outcome receipts and fetch public proof links.

What you can do
  • Log signed decision events to the ledger, with Audifact managing the signing key by default
  • Log outcome events linked to a prior decision by its event hash
  • Fetch the public proof payload for a single event, including trust labels, chain validity and anchor status
  • Register or look up an agent identity under the API key's organization
  • List an agent's decision events and outcome events, newest first, with paging
When to use it
Use it when you want a verifiable, tamper-evident record of an agent's consequential decisions, external actions or subagent delegations, and want to hand out proof links afterwards. It is meant as selective receipts (roughly 3 to 10 events per active day), not full tracing.
Requirements
A remote MCP endpoint at api.audifact.io over streamable HTTP, with no local package. An Audifact account and an API key (af_...) created in the dashboard, supplied in the X-API-Key header or the client's secret field.
Before you install
Every logged event consumes credits on the account that owns the API key, so logging costs money. The ledger is append-only: entries are signed and hash-chained and cannot be edited or deleted. Keep the API key out of chat and files and use the client's masked secret field. Public labels are off by default; the bundled skill redacts secrets and message bodies before writing, but summaries still leave your machine.

Installation

In SourceWeft

  1. Open Audifact in the dashboard and add it to a workspace.
  2. Connect X-API-Key credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.audifact%2Faudifact/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "audifact": {
      "type": "http",
      "url": "https://api.audifact.io/mcp",
      "headers": {
        "X-API-Key": "<YOUR_API_KEY>"
      }
    }
  }
}

README

Audifact agent plugin

Your agent keeps a signed receipt of its decisions.

This repo packages Audifact’s hosted MCP server (https://api.audifact.io/mcp) plus a skill that tells the agent to log consequential decisions, external actions, and subagent delegations — then hand you proof links (https://audifact.io/e/{event_hash}).

It is receipts, not silent full tracing. Target about 3–10 events per active day.

Install

1. Audifact API key (all clients)

  1. Create an account at https://audifact.io/signup (the plugin never creates accounts).
  2. Dashboard → API Keys → create a key (af_..., shown once).
  3. Paste it only into the client’s secret / masked field. Never into chat or files.

2. Pick your client

Official MCP Registry / VS Code / Copilot / other registry clients

Listed as io.audifact/audifact in the MCP Registry (search “audifact”). Add the remote server from the registry or your client’s MCP gallery. Provide X-API-Key when prompted. Metadata: server.json.

Claude Code (self-hosted marketplace — no review queue)

text
/plugin marketplace add audifact/audifact-plugin/plugin install audifact@audifact

Paste the key into Audifact API key (userConfig, stored in the OS keychain).

Grok Bot / Cursor (x.ai catalog)

Install from the catalog when listed. Paste the key into AUDIFACT_API_KEY.
(Repo renamed from grokbot-plugin → audifact-plugin; resubmit replaces the 2026-10-16 draft.)

Agent Skills only (npx skills add)

bash
npx skills add audifact/audifact-plugin

This installs the skill instructions. You still need the MCP server connected in the same client, or the skill has no tools to call.

3. Confirm

Ask the agent to confirm the Audifact connection. It should log one plugin_connected decision and return a proof URL.

⚠️ Append-only ledger

Everything logged is signed and hash-chained and cannot be edited or deleted. The skill redacts before writing: no secrets, tokens, passwords, full message bodies or file contents — only short summaries.

Billing

Every event consumes credits on the Audifact account that owns the API key.

Privacy

  • Public labels are off by default.
  • Each agent logs under its own agent_name (e.g. grokbot-cos, claude-code).

Tools

log_decision, log_outcome, get_proof, register_agent, list_agent_decisions (deprecated alias: list_my_recent_decisions), list_agent_outcomes.

Repo layout

PathRole
.mcp.jsonGrok/Cursor: X-API-Key: ${AUDIFACT_API_KEY}
.grok-plugin/x.ai / Grok Bot plugin manifest
.claude-plugin/Claude Code marketplace + userConfig key (overrides MCP auth for Claude)
skills/audifact/Agent Skills SKILL.md
server.jsonOfficial MCP Registry remote metadata
assets/logo.svgBrand AF monogram

License

MIT

Source: README.md at commit 12ad2d3

Tools

6

log_decision

Log a signed decision event to the ledger. Managed Mode (default for MCP): omit signing fields and pass agent_name - Audifact securely manages an Ed25519 keypair and signs on behalf of the agent. Events are immutable once recorded; managed mode provides strong auditability after receipt. For maximum provenance, use client-side signing via the SDK (agent_private_key_b64, or agent_public_key + signature). Linked outcomes must use the same signing method as the decision (managed or client-signed with the same agent key). Organization is always taken from the API key (do not send organization_id). Scenario hash is computed server-side from scenario_name + scenario_definition (+ optional context_schema) via resolve_scenario - you usually do not pass scenario_hash.

Parameterstssignatureagent_namecontext_jsondecision_typemetadata_jsonscenario_hashscenario_namecontext_schemadecision_labeldecision_valueagent_public_key+8 more

log_outcome

Log a signed outcome event linked to a prior decision via decision_event_hash. Managed Mode (default): omit signing fields - the managed key from the linked decision's agent is used automatically when the decision was also managed. For client-signed decisions, pass agent_private_key_b64 or agent_public_key + signature using the same agent key. Signing method must match the linked decision (managed or client-signed). Outcomes do not accept scenario fields - scenario context is inherited from the linked decision.

Parameterstssignatureagent_nameoutcome_typerequiredmetadata_jsonoutcome_labeloutcome_valuerequiredagent_public_keypublic_output_jsondecision_event_hashrequiredpublic_outcome_typepublic_outcome_label+2 more

get_proof

Get proof

Fetch the public proof payload for one ledger event by its 64-char hex event_hash. When to use: after log_decision/log_outcome when you need trust labels, chain validity, anchor status, or a paired-event proof URL. When NOT to use: to browse many decisions or outcomes — use list_agent_decisions / list_agent_outcomes first, then call get_proof on a chosen event_hash; do not use this to write events (use log_decision / log_outcome). Requires X-API-Key. Returns proof fields only for events in that key's org; unknown or other-org hashes return EVENT_NOT_FOUND (same message either way). Read-only; does not mutate the ledger. Response includes event_hash, event_type, event_seq, public_* mirrors, hash_valid, agent_chain_valid, trust_level, trust_label, proof_anchor_status_label, and chain metadata.

Parametersevent_hashrequired

register_agent

Register agent

Register or look up an agent identity under the API key's organization. When to use: before client-side signing flows that need a known public_key, or to attach a human-readable name to an existing key. When NOT to use: Managed Mode log_decision (pass agent_name instead — Audifact provisions the key); do not use this to log decisions or outcomes. Idempotent on public_key: repeating the same key returns the existing agent. Requires X-API-Key. Returns the agent record (id, public_key, name).

Parametersnamepublic_keyrequired

list_agent_decisions

List agent decisions

List decision events for one agent (by public key) in the API key's org, newest first by default. When to use: to review what an agent already logged, pick an event_hash for get_proof, or page through history before linking an outcome. When NOT to use: to list outcomes (use list_agent_outcomes); to fetch one event's trust/anchor proof (use get_proof); to write a new decision or outcome (use log_decision / log_outcome); this is org-scoped via X-API-Key (not a public explorer listing) and does not accept agent_name — pass the agent's public_key from a prior log_decision response or register_agent. Requires X-API-Key. Read-only. Unknown public keys return an empty decisions list (total 0), not an error. Returns {decisions, total, next_cursor, has_next}. Pass next_cursor as cursor for the next older page.

Parameterslimitcursoragent_public_keyrequired

list_agent_outcomes

List agent outcomes

List outcome events for one agent (by public key) in the API key's org, newest first by default. When to use: to audit what results an agent recorded, find an outcome event_hash for get_proof, or page outcomes without already knowing hashes. When NOT to use: to list decisions (use list_agent_decisions); to fetch one event's trust/anchor proof (use get_proof); to write a new decision or outcome (use log_decision / log_outcome); this is org-scoped via X-API-Key (not a public explorer listing) and does not accept agent_name — pass the agent's public_key from a prior log_decision / log_outcome response or register_agent. Requires X-API-Key. Read-only. Unknown public keys return an empty outcomes list (total 0), not an error. Returns {outcomes, total, next_cursor, has_next}. Each outcome includes decision_event_hash when linked. Pass next_cursor as cursor for the next older page.

Parameterslimitcursoragent_public_keyrequired

Version history

2
  1. v0.1.1LatestOct 19, 2026
  2. v0.1.0Oct 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.