open protocol · live substrate

Verifiable agent actions.

Every action becomes signed context for the next.

Add atrib at an SDK, MCP, or daemon boundary you already own. Selected actions become a signed context graph: who acted, what evidence mattered, and what the next agent should build on.
Then verify it without trusting us, or any single log.

Watch the walkthroughExplore the logGet startedView on GitHub
install
pnpm add @atrib/mcp
server.ts
import { atrib } from "@atrib/mcp"

server.use(atrib())

Why atrib exists

Agent systems already produce chats, traces, logs, and memory writes. What they rarely produce is a past another agent can prove and use: who signed the action, what evidence mattered, what changed, and which prior belief was superseded.

server.use(atrib()) adds that evidence without changing the primary path. Each action becomes a signed receipt inside a graph that grows and evolves. Recall, audit, handoff, and settlement can read from the same verified chain instead of four disconnected logs.

MCP 2026-07-28

One request in. A verifiable receipt out.

Add verifiable records to a tool call without adopting a new agent runtime or maintaining an atrib transport session. The request carries its context. The result can carry a receipt any verifier can check.

01 · call

Complete request

method "tools/call"
protocol "2026-07-28"
context "0123…cdef"
receipt ["token","record"]
02 · result

Normal tool output

content "invoice paid"
status "ok"
agent loop unchanged
no transport session
03 · receipt

Signed record

record "sha256:8d03…ae85"
creator "dnWS…JwMo"
context "0123…cdef"
signature verified

Stateless transport

No prior connection, initialize exchange, or session header is needed. Reads retry as new requests. Writes retry with the same complete arguments and action-bound idempotency key.

Durable signed state

The receipt proves what the named key signed. It does not prove a real-world claim is true. Authorization, tool-side, counterparty, and log evidence remain separate checks.

Read the integration guideInspect the independent proof

The layer

One layer, three primitives, a context graph.

atrib sits between the agents that act and the systems that read those actions.

Everything on the top plugs in through one package.

Everything on the bottom becomes context for the next pass.

Inputs
@atrib/agent + @atrib/mcp. Install either, the other, or both.
Agent
@atrib/agent
makes tool calls, reads the chain
Tool / Creator
@atrib/mcp
fulfills calls, signs responses
atribthe layer
01

Signature

Every action, provably authored. Ed25519 over canonical JSON.

02

Chain

Every action, linked to what caused it. A causal graph, by construction.

03

Receipt

Every chain, readable by anyone. Verified through receipts, traces, annotations, and revisions.

The cycle
01
Handoffs

The next agent starts from verified context, not memory drift.

02
Audit

Teams can replay which evidence changed a decision.

03
Improvement

Corrections become signed context for future work.

loops back

Receipts flow out, settle, audit, and return as the next trace. The loop closes by itself. You didn't write a single line to make that happen.

The surface

Two verbs, and the relationships you declare.

One verb writes and one verb reads. The graph is not built from a growing set of primitives; it is built from the relationships you declare on the way past, which is why adding a new kind of claim rarely means adding a new call.

attestwrites, and signs

One call. What it signs depends on the relationship you declare, and the schema rejects contradictions rather than guessing.

no ref → an observation
You noticed or concluded something in the present moment.
ref: { kind: "annotates" } → a mark on a past record
A record turned out to matter. Carries importance, topics and a one-line summary, so later recall can rank it.
ref: { kind: "revises" } → a supersession
You now hold a position incompatible with an earlier one. Carries the prior position, the new one, and the reason.

informed_by names the prior records that actually changed what you did. That is where the edges come from, so precision matters more than completeness: everything you happened to read is noise.

recallreads, and signs nothing

One call, dispatched by shape. Each shape answers a question you would otherwise have to hold in your head between sessions.

history
What did I do recently, or matching this filter?
content
What do I know about this topic across records?
walk
How did we get here? Lineage, forward or backward.
annotations
What did anyone say about this record's importance?
revisions
Has this position been superseded since?
chain
What happened in this session, in order?
orphans
What did I note and never follow up on?
by_signer
Who else has records here?
What it carries

It carries what you already use.

Every layer below already knows one part of what happened. None of them can prove any of the others, because each is a different vendor’s word for it. atrib replaces none of them and carries a record between them that anyone can check.

  • Agent runtimes

    which agent acted, under whose key

    Claude Agent SDKOpenAI AgentsLangGraphLangChainGoogle ADKMicrosoft Agent FrameworkVercel AI SDKMastra

  • Tools

    what it called, and what came back

    MCPBrowserbaseStagehandFirecrawl

  • Memory and context

    what it relied on when it decided

    Mem0LettaLlamaIndexGraphiti

  • Tracing

    what the host observed while it ran

    OpenInferenceOpenTelemetry

  • Payments and credentials

    what it committed to, and on whose authority

    x402x401AP2ACPUCPOpenETR

  • Agent to agent

    what was handed off, and what was still open

    A2A

Each of these has a working integration in the public repo. The list grows; the record format does not have to change when it does.

Builds on

ed25519
sha-256
rfc 6962
jcs
c2sp
opentelemetry

Each of these is open and standard. atrib wires them into signed context records that agents and people can verify.

The full chain

  1. 01Ed25519 signature (RFC 8032) over JCS-canonicalized JSON (RFC 8785).
  2. 02Record hash committed to an append-only Merkle log (RFC 6962).
  3. 03Log served via C2SP tlog-tiles, state signed as C2SP tlog-checkpoints.
  4. 04Each record bound to the agent's OpenTelemetry trace via its W3C Trace Context trace-id.

Verifying a record means checking the signature, the Merkle inclusion proof, and the checkpoint signature.

Why you can build on it

Context you don't have to trust us for.

  • 01
    Verifier-first

    Check the signature, the inclusion proof and the checkpoint yourself. The verifier is a pure function: no network, no clock, no randomness, so two runs on the same bundle agree.

  • 02
    More than one anchor

    A record can be anchored to an atrib log, Sigstore Rekor, an RFC 3161 timestamp, OpenTimestamps. Two under different operators and your trust stops ending at ours. One anchor is a tier, not a failure.

  • 03
    Anchor it later, without the key

    Anchoring is permissionless and post-hoc. Anyone can anchor an existing record hash to another service afterwards. No signed byte changes when they do.

  • 04
    Standard primitives

    Ed25519, SHA-256, JCS, RFC 6962, C2SP checkpoints, and OpenTelemetry trace context.

  • 05
    Composable adoption

    Use agent middleware, an MCP wrapper, OpenTelemetry spans, or the two verbs directly.

  • 06
    Self-hostable

    Apache 2.0. Run your own log; the verifier still has the same job.

Start in a minute

Install the package, add the middleware, then inspect the signed context graph in the explorer.

install
pnpm add @atrib/mcp
Watch the walkthroughExplore the logView on GitHubRead the spec