A signed receipt for every tool call an agent makes through the gateway. Who authorized it, what the agent saw, what it did, what depended on it. Checkable by anyone with the public keys.
| setup | the record is | who could still rewrite it |
|---|---|---|
| SDK in the agent's process | self-reported, every field claimed | the agent's own process |
| gateway, local log | observed outside the agent, tamper-evident to anyone holding a copy | the operator, who holds the key and the file |
| gateway, log run by someone else | tree heads signed by a key the operator does not hold | only the log's operator, with yours |
The full list of claims, who can check each, and against whom, is the proof table. What the gateway does not cover is on the deployment page. A hosted log is not built yet.
Receipts is what an agent did: the gateway, the in-process SDK, the log, and the verifier. A receipt names the tool, the arguments, the outcome, the policy decision, and the grant, with every field labelled attested, observed, or claimed.
State is what an agent believes: a fact ledger where every belief cites its receipt, can be superseded or retracted without losing history, and can be forgotten with a receipt as the certificate. explain answers, for one receipt id, the questions a security owner asks.
The ledger is a JSONL file, SQLite, or your Postgres. Recall stays in Mem0 or Zep through write-through adapters. Agents in Python, Go, Java, and Rust reach the gateway too.
npm install @agent-custody/receipts @agent-custody/statenpm install -g @agent-custody/receipts # the sidecar and the CLI
pip install agent-custodyGitHub · npm · PyPI · Apache-2.0. What each piece is for, when you need to choose.