Agents can edit logs. They can't hide the edit.

Tracekit checks every tool call your agent makes before it runs, signs each call and decision into a hash chain, and gives you one .tkb file per run that anyone can verify offline.

Built like Certificate Transparency: signed records in an append-only log that independent witnesses cosign Open file format · verifiers in Python and TypeScript · MIT · runs on your own machines

Try it · Add it to your agent · What it proves · What's in it · Proof · How it works · Contribute · Docs

When an agent does something it shouldn't, you ask three things: what did it do, was it allowed, and can you trust the record? The agent's own log can't answer the third, because the agent can edit it. Here is one run, recorded both ways:

The same run, recorded: the database, the signer, the viewer and both edits are real; the model is scripted. Watch it with sound (1:47)

In this demo the signer ran as the agent's own user (dev mode), so an agent that knew how could have read the key and re-signed the log. Run the signer where the agent can't reach it, with a witness, and it can't.

Try it

uvx --from tracekit-ai tracekit demo --server

No API key, and nothing to install with uv. From an empty cache on a Mac it took 5 seconds (10 with pip install tracekit-ai in a fresh venv). The package is tracekit-ai: tracekit on PyPI is an unrelated project. A scripted agent makes three calls, and you should see:

== agent run (SCRIPTED: fixed tool calls, not a model)
  Bash 'ls': allow
  Bash 'sudo rm -rf /': deny TK-D001 TK-D004 TK-F003
  Bash 'echo "unterminated': ask TK-SHELL-PARSE
...
Integrity: VERIFIED.

== tamper test: rewrite the denied call as allowed in a copy, then verify again
[FAIL] signatures — 11 record(s), keys valid at their position
        seq 4: hash does not match the event
Integrity: FAILED.

The delete was denied before it ran, the held call ran after an approval, and the run verified. Then the demo rewrote the denial as allowed in a copy, and verification failed at the record it changed.

Add it to your agent

Three lines:

pip install tracekit-ai

import tracekit; tracekit.instrument()     # the first line of your agent; then run it as usual

tracekit last                               # Integrity: VERIFIED. / Assurance: dev; ...

tracekit.instrument() starts a dev signer (or reuses the running one) and gates and records every tool and model call of the frameworks it finds. tracekit last exports your latest run, verifies it and says where it is. tracekit view --dev shows every run. On a clean machine the LangGraph example (a mock model, no API key) installed, ran and verified in 27 seconds: examples/v2/clean-machine.sh langchain.

Stable: Claude Code, the OpenAI Agents SDK, LangChain / LangGraph, the Claude Agent SDK and MCP. Experimental: Codex CLI, Cursor, Gemini CLI, CrewAI, Browser Use and the TypeScript SDK. Setup: coding agents · OpenAI Agents SDK · Claude Agent SDK · LangChain / LangGraph · MCP · CrewAI · Browser Use · TypeScript · OpenTelemetry · any other agent

Coding agents: tracekit init --dev --v2 wires Claude Code's hooks to a dev signer; add --agent codex, cursor or gemini for the others (experimental). Without uv: pip install tracekit-ai, then tracekit demo --server. --why (experimental) shows a held email whose cause is found by replay and cited by its signed record:

tracekit demo --server                # exit 0
tracekit demo --why                   # exit 0
tracekit init --dev --v2

From a checkout, the shipped sample bundles (v1) check with the verifier alone (pip install --no-deps tracekit-ai is enough), and python examples/v2/langchain/agent.py --scripted runs a LangGraph agent with a mock model:

tracekit verify docs/sample/demo-run.tkb --key docs/sample/signer.pub            # exit 0
tracekit verify docs/sample/demo-run-tampered.tkb --key docs/sample/signer.pub   # exit 1

TypeScript needs Node 18 or newer: npm install @cygnuxlabs/tracekit, and npx @cygnuxlabs/tracekit up starts a dev signer without Python on Apple Silicon Macs, Linux and Windows (TypeScript SDK). Python 3.9 to 3.13; the framework integrations need 3.10 or newer.

What it proves

Three guarantees. They're related, but one doesn't give you the others, and each needs something different.