open protocol · live substrate

Verifiable agent actions.

Instrumented actions can become signed context for the next.

Add atrib at an SDK, MCP, or daemon boundary you already own. Selected actions become a signed context graph: who acted, what evidence mattered, and what the next agent should build on.
Then verify it without trusting us, or any single log.

This page covers the open protocol and public services. The atrib app is a separate product and is not generally available.

Watch the walkthroughExplore the logGet startedView on GitHub
install
pnpm add @atrib/mcp
server.ts
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"
import { atrib } from "@atrib/mcp"

const server = atrib(new McpServer({ name: "my-tool", version: "1.0.0" }), {
  creatorKey: process.env.ATRIB_PRIVATE_KEY!,
  serverUrl: "https://my-tool.example.com",
})

Why atrib exists

Agent systems already produce chats, traces, logs, and memory writes. What they rarely produce is a past another agent can prove and use: who signed the action, what evidence mattered, what changed, and which prior belief was superseded.

server.use(atrib()) adds that evidence without changing the primary path. Each action becomes a signed receipt inside a graph that grows and evolves. Recall, audit, handoff, and settlement can read from the same verified chain instead of four disconnected logs.

MCP 2026-07-28

One request in. A verifiable receipt out.

Add verifiable records to a tool call without adopting a new agent runtime or maintaining an atrib transport session. The request carries its context. The result can carry a receipt any verifier can check.

01 · call

Complete request

method "tools/call"
protocol "2026-07-28"
context "0123…cdef"
receipt ["token","record"]
02 · result

Normal tool output

content "invoice paid"
status "ok"
agent loop unchanged
no transport session
03 · receipt

Signed record

record "sha256:8d03…ae85"
creator "dnWS…JwMo"
context "0123…cdef"
signature verified

Stateless transport

No prior connection, initialize exchange, or session header is needed. Reads retry as new requests. Writes retry with the same complete arguments and action-bound idempotency key.

Durable signed state

The receipt proves what the named key signed. It does not prove a real-world claim is true. Authorization, tool-side, counterparty, and log evidence remain separate checks.

Read the integration guideInspect the independent proof

The layer

One layer, three primitives, a context graph.

atrib sits between the agents that act and the systems that read those actions.

Instrumented inputs can plug in through a package.

Instrumented outputs can become signed context for the next pass.

Inputs
@atrib/agent + @atrib/mcp. Install either, the other, or both.
Agent
@atrib/agent
makes tool calls, reads the chain
Tool / Creator
@atrib/mcp
fulfills calls, signs responses
atribthe layer
01

Signature

Each instrumented action can be provably authored. Ed25519 over canonical JSON, with body disclosure left to the host.

02

Chain

Instrumented records can link to what caused them. The graph follows declared relationships.

03

Receipt

Recorded chains can be read and verified through receipts, traces, annotations, and revisions.

The cycle
01
Handoffs

The next agent starts from verified context, not memory drift.

02
Audit

Teams can replay which evidence changed a decision.

03
Improvement

Corrections become signed context for future work.

loops back

Recorded context can support handoffs, audits, and later work. What gets captured and disclosed depends on the boundary and its options; nothing here claims to instrument work you did not wrap.

The surface

Two verbs, and the relationships you declare.

One verb writes and one verb reads. The graph is not built from a growing set of primitives; it is built from the relationships you declare on the way past, which is why adding a new kind of claim rarely means adding a new call.

attestwrites, and signs

One call. What it signs depends on the relationship you declare, and the schema rejects contradictions rather than guessing.

no ref → an observation
You noticed or concluded something in the present moment.
ref: { kind: "annotates" } → a mark on a past record
A record turned out to matter. Carries importance, topics and a one-line summary, so later recall can rank it.
ref: { kind: "revises" } → a supersession
You now hold a position incompatible with an earlier one. Carries the prior position, the new one, and the reason.

informed_by names the prior records that actually changed what you did. That is where the edges come from, so precision matters more than completeness: everything you happened to read is noise.

recallreads, and signs nothing

One call, dispatched by shape. Each shape answers a question you would otherwise have to hold in your head between sessions.

history
What did I do recently, or matching this filter?
content
What do I know about this topic across records?
walk
How did we get here? Lineage, forward or backward.
annotations
What did anyone say about this record's importance?
revisions
Has this position been superseded since?
chain
What happened in this session, in order?
orphans
What did I note and never follow up on?
by_signer
Who else has records here?
What it carries

It carries what you already use.

Every layer below contributes a different view of what happened. None of them is a complete proof of the others, because each observes a different boundary. atrib replaces none of them and carries a record between them that anyone can check.

  • Agent runtimes

    which agent acted, under whose key

    Claude Agent SDKOpenAI AgentsLangGraphLangChainGoogle ADKMicrosoft Agent FrameworkVercel AI SDKMastra

  • Tools

    what it called, and what came back

    MCPBrowserbaseStagehandFirecrawl

  • Memory and context

    what it relied on when it decided

    Mem0LettaLlamaIndexGraphiti

  • Tracing

    what the host observed while it ran

    OpenInferenceOpenTelemetry

  • Commerce, payment, and evidence

    what it committed to, and on whose authority

    x402x401AP2ACPUCPOpenETR

  • Agent to agent

    what was handed off, and what was still open

    A2A

The public repo contains examples and proof paths for these layers. They are examples of surfaces atrib can carry evidence across, not an exhaustive protocol list. Integration maturity and evidence surface vary by example.

Builds on

ed25519
sha-256
rfc 6962
jcs
c2sp
opentelemetry

Each of these is open and standard. atrib wires them into signed context records that agents and people can verify.

The full chain

  1. 01Ed25519 signature (RFC 8032) over JCS-canonicalized JSON (RFC 8785).
  2. 02Record hash committed to an append-only Merkle log (RFC 6962).
  3. 03Log served via C2SP tlog-tiles, state signed as C2SP tlog-checkpoints.
  4. 04Each record bound to the agent's OpenTelemetry trace via its W3C Trace Context trace-id.

Verifying a record means checking the signature, the Merkle inclusion proof, and the checkpoint signature.

Why you can build on it

Context you don't have to trust us for.

  • 01
    Verifier-first

    Check the signature, the inclusion proof and the checkpoint yourself. The verifier is a pure function: no network, no clock, no randomness, so two runs on the same bundle agree.

  • 02
    More than one anchor

    A record can be anchored to an atrib log, Sigstore Rekor, an RFC 3161 timestamp, OpenTimestamps. Two under different operators and your trust stops ending at ours. One anchor is a tier, not a failure.

  • 03
    Anchor it later, without the key

    Anchoring is permissionless and post-hoc. Anyone can anchor an existing record hash to another service afterwards. No signed byte changes when they do.

  • 04
    Standard primitives

    Ed25519, SHA-256, JCS, RFC 6962, C2SP checkpoints, and OpenTelemetry trace context.

  • 05
    Composable adoption

    Use agent middleware, an MCP wrapper, OpenTelemetry spans, or the two verbs directly.

  • 06
    Self-hostable

    Apache 2.0. Run your own log; the verifier still has the same job.

Start in a minute

Install the package, add the middleware, then inspect the signed context graph in the explorer.

install
pnpm add @atrib/mcp
Watch the walkthroughExplore the logView on GitHubRead the spec