Tamper-evident audit trails for AI agents

The Agent Evidence Profile seals what an agent did — the run, its outputs, its tool calls, its approvals — into one portable evidence envelope. Hash-only by default, signed by the keys involved, settled on public systems, and verifiable by anyone with the open local verifier.

Create evidence →Verify a package →

What gets sealed

The profile maps agent activity to namespaced claims under org.fileonchain.agent — runId and agentId are required; everything else is opt-in and digest-based.

Agent runs

runId · agentId — required

Every envelope under the Agent Evidence Profile names the run and the agent that produced it, with optional session, parent run, organization, environment, timing, and completion status.

Output artifacts

subject digests

The envelope's subject is the thing itself — a report, generated code, a decision record — bound by SHA-256. Model metadata travels as digests: config digest, prompt digest, template id.

Tool call activity

toolCalls[] — input/output digests

Each tool call records its name, version, status, and SHA-256 digests of its input and output — plus an optional reference to the external trace (OpenTelemetry span, Langfuse trace) it came from.

Approvals & policy

approvals[] · policy

Human reviews, policy gates, and sign-offs record who approved what (by digest), under which policy, and — when backed by a cryptographic signature — point at the artifact signature that proves it.

Hash-only by default

Raw prompts and artifact bytes are never required. The profile references and hashes: a prompt travels as its SHA-256 digest, a tool output as its digest, an observability trace as a reference plus a digest. What leaves your infrastructure is evidence about the run — not the run's content. Anyone who later holds the real bytes can recompute the digests and prove they match; anyone who doesn't sees nothing sensitive. Storing bytes (on a storage system or an external URI you host) is an explicit, per-artifact opt-in.

Seal a run in one call

sealAgentRun from @fileonchain/sdk/evidence derives the subject from bytes, stamps the profile, collects artifact signatures, and returns a finalized envelope ready for receipts.

seal-run.ts

import { sealAgentRun } from "@fileonchain/sdk/evidence";

const envelope = await sealAgentRun({
  subjectBytes: reportBytes, // the agent's output artifact
  subjectMeta: { name: "quarterly-report.md", mediaType: "text/markdown" },
  run: {
    runId: "run_01J9X4T7",
    agentId: "agent://acme/research-analyst",
    model: { id: "claude-sonnet-4-5", promptDigest }, // digests, not prompts
    toolCalls: [
      { name: "web_search", inputDigest, outputDigest, status: "success" },
    ],
    approvals: [{ approverId: "user:maya", type: "human-review" }],
    status: "completed",
  },
  signers: [agentSigner], // agent key, wallet, or organization key
});
// → one portable evidence envelope: anchor it, then hand it over.

Try it from the tool your agent already uses

Cloud + SDK integration

@fileonchain/mcp is a stdio MCP server, an integration with FileOnChain Cloud and the reference SDK, not part of the protocol. Its verify_evidence tool runs the local verifier in-process with no key; the anchoring tools spend account credits through the hosted API. Add it to Claude Code:

terminal

claude mcp add fileonchain -- npx -y @fileonchain/mcp

Or to Cursor and other JSON-configured clients:

mcp.json

{
  "mcpServers": {
    "fileonchain": {
      "command": "npx",
      "args": ["-y", "@fileonchain/mcp"],
      "env": { "FILEONCHAIN_API_KEY": "${FILEONCHAIN_API_KEY}" }
    }
  }
}

One settlement transaction per session

Agent sessions produce many small artifacts, and one settlement transaction each would be wasteful. A signed manifest lists a session's artifacts, a Merkle tree over their digests reduces the batch to one root, and a single transaction settles the root — while each artifact's envelope carries its own inclusion proof back to it. Anchoring a manifest per session is the recommended default for agent workloads.

FileOnChain Cloud — the convenient way to run it

Everything above works self-managed: your keys, your RPC endpoints, the open-source SDK. The hosted product removes the operational work — honestly labeled by what's live today.

The Planned entries below are wired and gated behind FILEONCHAIN_CLOUD_EVIDENCE_ENABLED; the schema, routes, services, and pages ship in this build but the surfaces are not reachable for users until the flag is on. See the Cloud landing for the full inventory.

Managed anchoring with credits

Available

POST an artifact hash to the hosted API with a fok_ key; a funded worker settles it on the network you chose and returns the receipts. Pay with account credits — no wallets or gas handling in your agent.

API keys, jobs & activity history

Available

Scoped API keys, job polling for anchor requests, and a dashboard of everything your keys have sealed.

Retention & search

Planned

Managed retention of your envelopes and search across runs, agents, and sessions.

Hosted verification pages

Planned

Shareable per-envelope verification pages for counterparties who won't run a CLI. The local verifier remains the ground truth — hosted pages are a convenience, never a requirement.

Portable export, independent verification

The output is always a file — an evidence envelope you can export, archive, or hand to an auditor, a customer, or a regulator. They verify it without a FileOnChain account: paste it into the in-browser verifier or run fileonchain verify evidence.json locally. The checks — subject integrity, artifact and envelope signatures, receipts, key status — are defined by the open protocol, not by us.