Agent Receipts (ar) from the Agent Receipts team is a security tool that creates verifiable audit trails for AI agent actions, aimed at improving transparency and accountability. The tool generates cryptographically signed receipts and exposes a signing daemon plus a dashboard for verification and management. It supports SDKs across major languages and integrates with the Model Context Protocol, targeting AI developers, security engineers, and compliance officers in production environments.

What tasks can you actually use it for?

The tool produces tamper-evident records for individual agent steps, including tool executions and external API calls, so teams can reconstruct action sequences and timestamps. Developers use the command-line 'ar' to manage signing and inspect the receipt database. The dashboard provides searchable verification of generated receipts, supporting forensic review, compliance checks, and post-incident analysis in live agent workflows.

How reliable are the audit records in practice?

Reliability comes from linked records and isolated key custody. Each receipt is chained to the previous one with cryptographic signatures, which makes unauthorized edits detectable during verification. A background signing daemon keeps private keys separate from agent processes, preventing direct key access by running agents. Receipts are typically stored on the host and can be inspected locally via the dashboard for integrity checks.

Is integration with existing agent code straightforward?

Integration uses native SDKs that let agent code emit action receipts as part of normal operations. The 'ar' command-line tool also administers the signing daemon and receipt store, enabling scripted deployment and basic automation of verification tasks.

• Python
• TypeScript
• Go

What are the privacy and deployment trade-offs?

The tool follows a local-first deployment model, keeping receipts in a host-side database that the dashboard reads, which reduces dependence on centralized third parties. That approach requires teams to manage backups, host security, and access controls. Supported SDKs run on major operating systems, so deployment mirrors existing infrastructure, yet operators should plan for routine verification and retention policies as part of compliance workflows.

A practical choice for governed agent deployments

Ar suits teams running governance programs for autonomous agents, especially groups that accept host-side audit storage and procedural verification. It demands operational discipline, including regular verification, host backups, and access controls, to deliver predictable accountability. Compliance officers and security engineers benefit most when those practices are documented and automated. Integrate receipt checks into standard audits and enforce retention reviews to keep the audit trail reliable and reviewable.