Inspiration Agents have moved past simple chat interfaces. They take action autonomously. Using the Model Context Protocol (MCP), they can execute shell commands, alter filesystems, and read production SSH keys right on a local machine.
Giving an agent this much freedom without clear liability introduces massive risk. When an agent wipes a database, who takes the blame? The model provider, the tool vendor, or the developer? I was personally burned by antigravity agentic system that hallucinated decisions and made me burn 400 euros worth of credits in RunPod. As a broke entrepreneur I learned a very expensive lesson. DO nit trust agents blindly. It can lie. It can deceive. It can hallucinate. And who do you hold accountable? I emailed google. Provided them clear evidence of chat ID and where exactly the agent lied. But they still refuse to acknowledge saying that I still could have tampered the evidence. Its time to fight back.
Major cloud providers like AWS and Microsoft track activity inside their own APIs. They cannot see what an agent does locally through standard I/O pipes. The space lacked a flight data recorder for autonomous operations. That gap led us to build AgentWitness. It acts as an OS-level liability ledger and an irreversibility firewall. It sits right between the AI brain and the host system to secure that exact boundary.
What it does AgentWitness functions as an irreversibility firewall for any agent using MCP. The system separates accountability into three parts.
First, a local Rust daemon operates as a proxy at the OS kernel layer. It intercepts JSON-RPC calls passing through the raw standard I/O pipes. A parameter-aware policy engine then classifies these events, defaulting to deny.
Second, a remote FastAPI ledger issues short-lived TTL leases signed with Ed25519 keys. When the proxy detects an irreversible action, it writes the event to this tamper-evident Merkle chain. If the network drops, the proxy queues the event locally in a durable SQLite database so execution continues without interruption.
Third, we (I and codex) built an offline verification portal using static HTML. Auditors paste an event bundle along with an expected anchor hash into the browser. The portal runs a full client-side check of the signature chain. This proves the chain of custody mathematically.
How we built it We wrote the interceptor daemon in Rust. It uses the Tokio async runtime to monitor the parent standard input and child standard output streams, reading JSON-RPC payloads in real time.
The remote ledger is a Python FastAPI service. We backed it with an SQLite database running in WAL mode. Using explicit BEGIN EXCLUSIVE locks allows the ledger to handle high-throughput agent traffic while keeping the linear chain consistent.
For the AI integration requirement, we used OpenAI's Codex extensively. It wrote the bulk of the Rust async interception logic and the FastAPI cryptographic handshakes. We also used GPT-5.6 Terra and Sol to pressure-test our zero-trust architecture. Those models provided the dynamic semantic analysis that runs our parameter-aware policy engine.
The Cryptographic Seal (The Math) To solve the garbage-in, crypto-out oracle problem, the system uses dual Ed25519 signatures and a linear hash chain.
When the local daemon intercepts a payload, it generates a device signature:
h_local = SHA-256( PayloadHash || LocalTimestamp || DeviceID || Nonce || AgentID || Status ) Sig_device = Sign_Ed25519( h_local, Key_Device_Private ) The remote ledger receives this signature and links it to the previous event, returning a cryptographic receipt:
ChainHash = SHA-256( PreviousHash || h_local || LedgerTimestamp ) Receipt = Sign_Ed25519( ... || ChainHash, Key_Ledger_Private )
Challenges we ran into We originally wanted to build AgentWitness as a Python SDK. But a logger running inside the application code is vulnerable. A hallucinating agent could easily alter the data before logging it. We had to pivot to an OS-level interception architecture using Rust standard I/O proxying instead.
Midway through development, we submitted the architecture to Anthropic's Fable 5 model for an adversarial review. This s a practice that really helps me. I call it council feedback. It found two massive flaws: chain truncation attacks (an attacker silently deleting the last five rows) and delimiter injection. We rewrote large portions of the system. We added strict Pydantic regex constraints (^[a-zA-Z0-9_-]+$). We also decoupled the verification logic into an air-gapped portal that enforces a strict expected anchor check. Now, hiding a deleted event breaks the math completely.
Accomplishments that we're proud of We survived an independent, adversarial AI review. After applying strict fail-closed constraints, the reviewer gave the architecture a top-tier rating.
We built a firewall that does not introduce latency. Most safety tools put a network gate in front of every action, which kills production speed. We used short-lived TTL leases and local asynchronous durable queues. This bound the destructive blast radius of autonomous agents without slowing them down.
The verification demo works completely offline. The static HTML portal recalculates Merkle chains and Ed25519 signatures locally. If a single byte is out of place, the entire screen flashes red.
What we learned Endpoint protocol neutrality is a defensible moat. Large tech companies are structurally incentivized to build security logs only for their own walled gardens. By building an agnostic OS-level daemon, we realized independent developers can provide cross-vendor trust and liability. Cloud providers cannot replicate this approach.
What's next for AgentWitness The current parameter-aware policy engine defaults to deny. We want to push this further.
Next, we plan to integrate WebAssembly (Wasm) sandboxing directly into the Rust proxy. This lets organizations push complex, proprietary semantic analysis scripts to the edge where the agent runs. The proxy could actively terminate the standard I/O pipe based on real-time heuristic checks before any damage occurs. We will also integrate OpenTimestamps to anchor the final chain hash directly to the Bitcoin blockchain. And I am going to submit this to alliance accelerator program and try to build a company out of this
Log in or sign up for Devpost to join the conversation.