PkgFoundry
Catalog PyPI
Back to packageRELEASE DETAILS

0.1.0

PyPI

aat-mcp

Conformant AAT (draft-sharif-agent-audit-trail-06) audit-trail recorder + MCP middleware: signed, hash-chained, tamper-evident, offline-verifiable evidence for AI agent tool calls.

Published29 Sept 2026
Direct dependencies4
Transitive dependenciesNot calculated

README

Version 0.1.0 documentation

aat-mcp

Signed, tamper-evident audit trail for MCP tool calls, conformant to draft-sharif-agent-audit-trail-06. Every agent tool invocation becomes a signed, hash-chained record that an independent party can verify offline, without trusting the producer.

Containment sandboxes control what an agent may touch. This records who did what, whether it was allowed, and proves it — the governance + evidence layer on top.

What it does (per the spec)

  • 12 mandatory record fields; JCS (RFC 8785) canonicalization.
  • Chain: prev_hash(N) = hex(SHA-256(JCS(record(N-1)))).
  • ES256 signatures (ECDSA P-256 over SHA-256, IEEE-P1363 r‖s, base64url); sig_alg/signer_kid are covered by the signature.
  • Pre-execution recording of enforcement decisions (deny is evidence).
  • Privacy by design: inputs/outputs are digested, never stored raw.

Quickstart

from aat import core
from aat.mcp import MCPRecorder

rec = MCPRecorder(agent_id="urn:agent:bot.example", agent_version="1.0.0",
                  private_key=core.gen_key(), trust_level="L2")
rec.open_session()

# wrap any MCP tool handler; every call is recorded + policy-gated
safe = rec.wrap(handler, policy=lambda name, args: name != "delete_prod_db")
safe("send_payment", {"to": "+100", "amount": 50})

ok, issues = rec.verify()          # chain + every signature

Verify offline (third party, public key only)

from aat import core
ok, issues = core.verify_chain(records, {kid: public_key})

Tests

.venv/bin/python tests/test_aat.py — 23/23 (chain, signatures, tamper on every axis, dropped-record detection, MCP flow, policy-deny, privacy, independent verify).

Apache-2.0. Reference implementation of an open IETF draft.

Downloads & popularity

Awaiting observations

No metric observations yet

Download counts and popularity will appear here as the collector receives them.

Declared dependencies 6

Native requirements
4 direct targetsNot calculated transitive count
Package / targetRequirementRelationship
cryptography
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
cryptography>=42runtime
rfc8785
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
rfc8785>=0.1.4runtime
langchain-core
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
langchain-core>=0.3; extra == "all"runtime
pydantic-ai-slim
Environment
{
  "extras": "",
  "marker": "extra == \"all\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
pydantic-ai-slim>=0.3; extra == "all"runtime
langchain-core
Environment
{
  "extras": "",
  "marker": "extra == \"langchain\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
langchain-core>=0.3; extra == "langchain"runtime
pydantic-ai-slim
Environment
{
  "extras": "",
  "marker": "extra == \"pydantic-ai\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
pydantic-ai-slim>=0.3; extra == "pydantic-ai"runtime

Distribution files

2 collected
aat_mcp-0.1.0-py3-none-any.whl

bdist_wheel · 9.31 KB · Python py3

Source file
aat_mcp-0.1.0.tar.gz

sdist · 10.09 KB · Python source

Source file

Metadata history

Meaningful changes
Current collected state Current

Observed since 20 Oct, 17:05 UTC

No superseded metadata states collected. Unchanged observations do not create new revisions.

Record identity

package_version:7f45fcb5ebbb857056c2ed21530b1b82162deda542c850f2c45da2c3893b8e18

Other collected versions

View all collected versions →