aat-mcp

aat-mcp

Signed, tamper-evident audit trail for MCP tool calls, conformant to draft-sharif-agent-audit-trail-06. Every agent tool invocation becomes a signed, hash-chained record that an independent party can verify offline, without trusting the producer.

Containment sandboxes control what an agent may touch. This records who did what, whether it was allowed, and proves it — the governance + evidence layer on top.

What it does (per the spec)

• 12 mandatory record fields; JCS (RFC 8785) canonicalization.
• Chain: prev_hash(N) = hex(SHA-256(JCS(record(N-1)))).
• ES256 signatures (ECDSA P-256 over SHA-256, IEEE-P1363 r‖s, base64url); sig_alg/signer_kid are covered by the signature.
• Pre-execution recording of enforcement decisions (deny is evidence).
• Privacy by design: inputs/outputs are digested, never stored raw.

Quickstart

from aat import core
from aat.mcp import MCPRecorder

rec = MCPRecorder(agent_id="urn:agent:bot.example", agent_version="1.0.0",
                  private_key=core.gen_key(), trust_level="L2")
rec.open_session()

# wrap any MCP tool handler; every call is recorded + policy-gated
safe = rec.wrap(handler, policy=lambda name, args: name != "delete_prod_db")
safe("send_payment", {"to": "+100", "amount": 50})

ok, issues = rec.verify()          # chain + every signature

Verify offline (third party, public key only)

from aat import core
ok, issues = core.verify_chain(records, {kid: public_key})

Tests

.venv/bin/python tests/test_aat.py — 23/23 (chain, signatures, tamper on every axis, dropped-record detection, MCP flow, policy-deny, privacy, independent verify).

Apache-2.0. Reference implementation of an open IETF draft.