Tracekit MCP gateway

When an agent does something it shouldn't, you ask three things: what did it do, was it allowed, and can you trust the record? The agent's own log can't answer the third, because the agent can edit it. Here is one run, recorded both ways:

[A ticket with a hidden instruction makes a support agent delete 43 orders, then edit its own log and Tracekit's record of the delete. grep finds no delete; Tracekit marks the run FAILED because record 7 no longer matches its hash.]

_{The same run, recorded: the database, the signer, the viewer and both edits are real; the model is scripted. Watch it with sound (1:47)}

In this demo the signer ran as the agent's own user (dev mode), so an agent that knew how could have read the key and re-signed the log. Run the signer where the agent can't reach it, with a witness, and it can't.

Try it

uvx --from tracekit-ai tracekit demo --server

No API key, and nothing to install with uv. From an empty cache on a Mac it took 5 seconds (10 with pip install tracekit-ai in a fresh venv). The package is tracekit-ai: tracekit on PyPI is an unrelated project. A scripted agent makes three calls, and you should see:

== agent run (SCRIPTED: fixed tool calls, not a model)  Bash 'ls': allow  Bash 'sudo rm -rf /': deny TK-D001 TK-D004 TK-F003  Bash 'echo "unterminated': ask TK-SHELL-PARSE...Integrity: VERIFIED.
== tamper test: rewrite the denied call as allowed in a copy, then verify again[FAIL] signatures — 11 record(s), keys valid at their position        seq 4: hash does not match the eventIntegrity: FAILED.

The delete was denied before it ran, the held call ran after an approval, and the run verified. Then the demo rewrote the denial as allowed in a copy, and verification failed at the record it changed.

Add it to your agent

Three lines:

pip install tracekit-ai

import tracekit; tracekit.instrument()     # the first line of your agent; then run it as usual

tracekit last                               # Integrity: VERIFIED. / Assurance: dev; ...

tracekit.instrument() starts a dev signer (or reuses the running one) and gates and records every tool and model call of the frameworks it finds. tracekit last exports your latest run, verifies it and says where it is. tracekit view --dev shows every run. On a clean machine the LangGraph example (a mock model, no API key) installed, ran and verified in 27 seconds: examples/v2/clean-machine.sh langchain.

_{Stable: Claude Code, the OpenAI Agents SDK, LangChain / LangGraph, the Claude Agent SDK and MCP. Experimental: Codex CLI, Cursor, Gemini CLI, CrewAI, Browser Use, Pydantic AI, Google ADK, Haystack, LlamaIndex, Microsoft Agent Framework, Strands Agents, the Vercel AI SDK, NVIDIA OpenShell, E2B, microsandbox, agentgateway, Wassette, LiteLLM's MCP gateway, Docker's MCP Gateway and the TypeScript SDK. In NVIDIA OpenShell sandboxes, Tracekit decides and signs each HTTP request OpenShell lets out, and signs OpenShell's own blocks, process events and policy changes into the same run. Setup: coding agents · OpenAI Agents SDK · Claude Agent SDK · LangChain / LangGraph · MCP · Wassette · CrewAI · Browser Use · Pydantic AI · Google ADK · Haystack · LlamaIndex · Microsoft Agent Framework · Strands Agents · NVIDIA OpenShell · LiteLLM · TypeScript · Vercel AI SDK · agentgateway · microsandbox · E2B · Docker MCP Gateway · OpenTelemetry · any other agent}

tracekit demo --server                # exit 0tracekit demo --why                   # exit 0tracekit init --dev --v2

tracekit verify docs/sample/demo-run.tkb --key docs/sample/signer.pub            # exit 0tracekit verify docs/sample/demo-run-tampered.tkb --key docs/sample/signer.pub   # exit 1

What it proves

Three guarantees. They're related, but one doesn't give you the others, and each needs something different.

Limits

• Dev mode protects nothing against an agent that runs as you. Dev runs say isolation: same-user (FAQ).
• A verified run proves the record is intact: not intent, not that a reported tool result is true, and not that every action was captured (FAQ). tracekit analyze --v2 compares what was asked, what the model said and what ran, but what the model said is its own account, and findings are an opinion beside the integrity, never part of it (findings).
• Actions outside the capture path leave no record, such as a subprocess a hook never sees and no kernel sensor import covers, or code that skips the adapter (adapters).
• Policy rules match text and tool names. A determined agent can reword a command; the protection is the signer's isolation (policy reference).
• Commitments hide content, not timing, sizes or counts (privacy).

What each deployment guarantees, from dev mode to a signer the agent can't reach: guarantees. Every limit, with what to do about it: limits. How it maps to the EU AI Act, ISO/IEC 42001, the NIST AI RMF and OWASP: compliance.

What's in it

One signer. The core is stable and is hardened first. The rest ships in the same package as experimental: it works and is tested, but may change between releases (what's stable).

Proof

Our own experiments: small, synthetic and written by us. Nothing rounded up. The misses stay in.

The two E1 misses are the design: a log can't see its own tail cut off, and whoever holds the key can re-sign it. Only a copy of the head held elsewhere, a witness, catches those, so an unwitnessed run verifies as dev. The test sets were written by us, and no one outside has reviewed the threat models yet. Every experiment, and what isn't measured: evaluation · technical report.

How it works

• The agent never holds a signing key and never assigns sequence numbers.
• Each record is signed and carries the hash of the one before it, so a changed byte fails verification at that record.
• Nothing the agent reports about itself is trusted: not its isolation, its fail mode, gaps, or who approved a call.
• Who can rewrite the log decides what a run is worth, so put the signer where the agent can't reach it. The agent's code is the same in every mode; TRACEKIT_SIGNER points it at the signer.

The operator who runs the signer could still rewrite its log with its own key; an independent witness and a monitor make that visible. Each mode end to end: deployment. The full model: architecture, laptop and server threat models.

Is it for you?

For debugging a prototype, a tracer such as OpenTelemetry, Langfuse or LangSmith is the right tool. Tracekit doesn't replace one; it's the record you can hand to someone who doesn't trust the agent. How it compares with tracers, guardrail libraries and other tamper-evident logs, and when it's the wrong choice: comparisons.

Pilot it with us

Running an agent that acts on real systems, with someone who has to sign off on it: a customer, an auditor, an insurer? We'll set up Tracekit with you for two weeks, free: one agent, on your machines. At the end you have a verified evidence file for every run and a written review of what the agent did that you didn't expect. Email [email protected] or open a pilot request.

Commands

tracekit demo --server                      # allow, deny, approve, then a tampered copy fails verificationtracekit up                                 # start the dev signer, or find the running onetracekit last                               # export your latest run, pin the dev key, verify ittracekit view --dev                         # every run, verified: calls, decisions, gaps, replay, whytracekit approvals list                     # calls held for a person; tracekit approvals approve IDtracekit export --v2 --run ID -o run.tkb    # one run as one .tkb filetracekit verify run.tkb --trust trust.json  # offline, against the keys you pinned in trust.json                                            # (tracekit signer trust -o trust.json, or the one tracekit last wrote)tracekit policy lint policy.yaml            # check a policy before the signer loads ittracekit doctor                             # check this setuptracekit init --dev --v2                    # wire Claude Code's hooks; add --agent codex, cursor, gemini or opencode

Nothing to install for whoever checks a run: the browser verifier, one page, takes the .tkb and its trust file, sends nothing anywhere, and says VERIFIED, FAILED or UNVERIFIABLE with what it means and what to do next.

The evidence format

• Specified. Evidence format v2 aims to be precise enough to write an independent verifier, with normative test vectors.
• Built on standards. Records are signed with Ed25519 over RFC 8785 canonical JSON. Each log is an RFC 6962 Merkle tree, the structure Certificate Transparency uses. Checkpoints are C2SP signed notes, and witnesses cosign them per C2SP tlog-cosignature.
• Self-contained. A .tkb file is a zip of records, inclusion proofs, checkpoints and the policy snapshots that decided the calls. It holds no verification code.
• Old files keep verifying. Formats only grow, each format's verifier is frozen, and an older verifier reports a newer file UNVERIFIABLE (needs tracekit >= x), never FAILED. Verify such a file with uvx --from "tracekit-ai>=x" tracekit verify run.tkb --trust trust.json, npx -y @cygnuxlabs/tracekit@latest verify run.tkb --trust trust.json (Node 20.12 or newer), or the browser verifier, which checks it in your browser and sends nothing. From 1.4.0, an addition an older verifier can leave unread is non-critical: the bundle verifies, and the report names what that verifier didn't interpret.

Verify a v1 bundle in GitHub Actions with uses: Cygnux-Labs/Tracekit@main (bundle: and key: or witness:). require-anchor defaults to true, so an unanchored bundle fails the step; set require-anchor: "false" to only report it.

Contribute

Each of these is useful on its own, and none needs to know the whole codebase:

• Write a verifier in another language. The evidence format is specified and has test vectors. A Go or Rust verifier written from the spec alone is the best test that the spec is complete.
• Find a harmful call the packs let through. Add it to tests/data/policy/deny/ with a rule that catches it; E17 runs every case.
• Run Tracekit on your own agent and report what broke. Doing that with two open-source agents found real bugs (case study).
• Add a framework. An integration is done when it passes the adapter contract.
• Try to break it. Find a tamper or a bypass that E1 and E8 miss, and report it privately as SECURITY.md describes. Everyone who finds one is named in the hall of fame unless they ask us not to.

To start: make install, then make check (contributing). Smaller tasks are labelled good first issue. Everyone taking part follows the code of conduct.

Docs

License

MIT, Copyright Cygnux Labs. This is 1.5.2, and 1.x is the supported line. Report vulnerabilities privately as SECURITY.md describes.

Cite

The paper: Tracekit-v2-paper.pdf (arXiv:2609.35659).

@misc{ghosh2026tracekit,  author        = {Bravish Ghosh},  title         = {Tracekit: Tamper-Evident Intent-Reasoning-Action Auditing for AI Agents},  year          = {2026},  eprint        = {2609.35659},  archivePrefix = {arXiv},  url           = {https://arxiv.org/abs/2609.35659},  note          = {Code: \url{https://github.com/Cygnux-Labs/Tracekit}}}