DEV Community: PiQrypt

Watch your CrewAI agents in real-time with PiQrypt Vigil

PiQrypt — Fri, 17 Apr 2026 06:18:44 +0000

You've added cryptographic audit trails to your crew (part 1)
and co-signed the handoffs between agents (part 2).

You now have tamper-evident history. But that's retrospective — you find out
something went wrong after the fact, when you run verify_chain().

Vigil is the real-time layer. It watches your agents while they run and raises
alerts the moment behavioural anomalies appear in the chain.

What Vigil is

Vigil is a local HTTP dashboard that launches on http://localhost:8421.
No external dependency. No data leaves your machine. It reads the same
AISS event chains your agents are writing and computes a VRS
(Verifiable Risk Score) in real time.

One command:

pip install piqrypt

Vigil is included. To start it:

from vigil import start_vigil
start_vigil()
# Dashboard running at http://localhost:8421

Or from the CLI:

piqrypt vigil start

What VRS measures

VRS is a composite risk score — a number between 0 and 1, where 1 means
the chain is healthy and 0 means it's compromised. It's computed across
five cryptographic dimensions:

Integrity — are all hashes in the chain consistent?
Verified interactions — are A2A handoffs co-signed as expected?
Diversity — is the event type distribution normal, or is the agent doing something anomalous?
Finalization — are events being properly closed?
Rotation health — if the agent rotated its key, is the PCP continuity intact?

Critically: VRS is deterministic. No ML, no probabilistic scoring, no model
that could drift. Given the same chain, any third party running the same
verification gets the same score.

A full CrewAI setup with Vigil

from crewai import Crew, Task
from piqrypt.bridges.crewai import AuditedAgent as Agent
from vigil import start_vigil

# Start Vigil before the crew runs
start_vigil()  # → http://localhost:8421

researcher = Agent(
    role="Researcher",
    goal="Find competitive pricing data",
    backstory="Expert at finding and analyzing market data.",
    agent_name="researcher_01"
)

writer = Agent(
    role="Writer",
    goal="Produce a pricing analysis report",
    backstory="Turns raw data into clear executive summaries.",
    agent_name="writer_01"
)

research_task = Task(
    description="Research competitor pricing for product X",
    agent=researcher
)

write_task = Task(
    description="Write a pricing analysis based on the research",
    agent=writer
)

crew = Crew(
    agents=[researcher, writer],
    tasks=[research_task, write_task]
)

result = crew.kickoff()
# While the crew runs, Vigil shows VRS and chain health per agent in real time

Open http://localhost:8421. You'll see a dashboard per agent — event count,
VRS, chain health, and a SOC-style timeline of events as they're stamped.

What a CRITICAL alert looks like

If researcher_01's VRS drops below the critical threshold, Vigil raises an
alert:
[CRITICAL] researcher_01 — chain anomaly detected
VRS: 0.21 (threshold: 0.30)
Event #34: previous_hash mismatch
Affected events: 34 → end of chain

This means: someone (or something) modified event 34 after it was written.
Every subsequent hash is now invalid. The chain is compromised from that
point forward.

Vigil alerts. It never acts. The human decides what to do — that's the
design principle. Automated blocking without human decision is not in scope.

A real example: the PixelFlow agency

The PiQrypt repo includes a runnable demo with a digital content agency —
three CrewAI agents running on Claude Haiku, all monitored live in Vigil.

# From repo root
.\demos\start_families.ps1 pixelflow
# Opens Vigil automatically at http://localhost:8421

Three agents, three distinct behavioural profiles:

pixelflow_content (Content Creator) — watch profile, TSI drift signal. Runs 3 content sessions per day. Vigil tracks the drift in event diversity over time.
pixelflow_seo (SEO Analyst) — safe profile, A2C concentration signal. 88% of its interactions go to pixelflow_content. Vigil flags this concentration pattern.
pixelflow_scheduler (Social Scheduler) — alert profile, temporal sync signal. Shares the same Claude Haiku backend as the other two — Vigil detects the timing correlation as a CRITICAL anomaly.

All three interact with external peers: anthropic_api, google_search_console,
instagram_api, twitter_api, analytics_ga4. Every interaction is
hash-chained. Every A2A handoff between agents carries a co-signed
interaction_hash in both chains.

The demo runs in loop mode, injecting events every 5 seconds. Vigil
recalculates VRS in real time. You can watch the pixelflow_scheduler
trust score degrade as the temporal sync pattern accumulates — without
touching a single line of your crew definition.

Full demo code: github.com/piqrypt/piqrypt/demos

Checking chain integrity programmatically

You don't have to use the dashboard. You can verify a chain directly:

import piqrypt as aiss
from aiss.exceptions import InvalidChainError

events = aiss.load_events("researcher_01")

try:
    aiss.verify_chain(events)
    print(f"Chain intact — {len(events)} events verified")
except InvalidChainError as e:
    print(f"Chain compromised: {e}")

verify_chain() is binary — it returns cleanly if the chain is intact,
or raises InvalidChainError the moment a broken link is found. No score,
no partial result. The failure message tells you which link broke and why.

The VRS score with thresholds (CRITICAL below 0.30, healthy above 0.70)
is what Vigil computes continuously from the live chain and displays in
the dashboard. These are two different tools for two different moments:
verify_chain() is a point-in-time integrity check you call explicitly;
Vigil is the continuous watch that alerts you before you think to check.

Standard vs Pro

The Vigil included in pip install piqrypt (standard tier) gives you:

Full dashboard UI
VRS with 7-day history
CRITICAL alerts
Up to 2 bridge types monitored
Chain health per agent

Vigil Pro adds 90-day VRS history, all alert levels (WARNING, INFO, DEBUG),
unlimited bridge types, and TrustGate integration — the governance layer
that intercepts agent actions before execution and routes to a human when
policy requires it.

For most development and staging use cases, the standard tier is enough.

The full picture

Three articles, one integration pattern:

Part 1 — drop-in bridge, 3 lines, every agent action is now
Ed25519-signed and hash-chained.

Part 2 — A2A co-signing, the handoffs between agents carry
cryptographic proof that neither side can deny.

Part 3 — Vigil, real-time monitoring of chain health and behavioural
anomalies while the crew runs.

Together: your CrewAI crew has tamper-evident history, non-repudiable
inter-agent accountability, and live anomaly detection. None of it requires
a server, an account, or sending data anywhere.

Part 1: How I added cryptographic audit trails to any CrewAI crew in 3 lines

Part 2: Multi-agent accountability: who co-signs the handoff between your CrewAI agents?

GitHub: github.com/piqrypt/piqrypt
pip install piqrypt
Protocol spec (MIT): github.com/piqrypt/aiss-standard

Multi-agent accountability: who co-signs the handoff between your CrewAI agents?

PiQrypt — Wed, 15 Apr 2026 10:03:12 +0000

In the previous article, we added cryptographic audit trails
to individual CrewAI agents in 3 lines. Each agent now has its own hash-chained,
Ed25519-signed event history.

But in a real crew, agents don't work in isolation. The Researcher produces
output. The Writer consumes it. The Reviewer validates it. These handoffs are
where the real accountability gap lives.

Who cryptographically proves that the Researcher actually produced that specific
output, and that the Writer actually received it unmodified?

The gap that logs don't close

You can read your crew's logs and reconstruct what happened. But logs are
unilateral — they record what one agent observed. If you want to prove a
handoff to a third party (an auditor, a regulator, a client), you need
something both sides signed.

In legal terms: you need non-repudiation. Neither party can deny the interaction
occurred, because both chains contain the same proof.

How PiQrypt's A2A protocol works

When two PiQrypt-equipped agents interact, the exchange produces an
interaction_hash — a deterministic identifier of the interaction payload,
present in both agents' chains. To falsify the exchange, you'd have to
modify both chains simultaneously and maintain hash consistency across both.
That's cryptographically intractable.

The mechanism: a pairwise Ed25519 handshake — proposal from agent A, response
from agent B, co-signed event appended to both chains. Same interaction_hash
in both memories.

The code

from crewai import Crew, Task
from piqrypt.bridges.crewai import AuditedAgent as Agent

# Each agent gets its own cryptographic identity
researcher = Agent(
    role="Researcher",
    goal="Find competitive pricing data",
    backstory="Expert at finding and analyzing market data.",
    agent_name="researcher_01"
)

writer = Agent(
    role="Writer",
    goal="Produce a pricing analysis report",
    backstory="Turns raw data into clear executive summaries.",
    agent_name="writer_01"
)

When the Researcher passes its findings to the Writer, you record the handoff
explicitly. The keys are the ones returned when the identities were created
via aiss.generate_keypair() — store them at agent init time.

python
from aiss.a2a import perform_handshake, record_external_interaction
import hashlib

# Establish cryptographic trust between the two agents (once per pair)
handshake = perform_handshake(
    researcher_private_key,
    researcher_public_key,
    researcher_agent_id,
    peer_agent_id=writer_agent_id,
    peer_public_key=writer_public_key
)

# Record the actual handoff
payload_hash = hashlib.sha256(findings_text.encode()).hexdigest()

record_external_interaction(
    researcher_private_key,
    researcher_agent_id,
    peer_id=writer_agent_id,
    interaction_type="findings_handoff",
    payload_hash=payload_hash  # content is hashed, never stored raw
)

The payload_hash is now in both chains. Neither agent can claim the
interaction didn't happen. Neither can claim a different payload was
transmitted.
What about agents outside your crew?
If your pipeline calls an external agent that doesn't have PiQrypt,
you still record your side:

python
# Peer without PiQrypt — unilateral proof, honestly recorded
record_external_interaction(
    researcher_private_key,
    researcher_agent_id,
    peer_id="external_autogen_analyst",
    interaction_type="result_transmitted",
    payload_hash=payload_hash
)
# Your chain proves you transmitted this payload at this timestamp.
# The peer didn't co-sign — that fact is visible in the record.

Your chain records the interaction. The absence of a co-signature is
structurally visible — you prove your side, and any auditor can see the
peer didn't participate in the proof.

Verifying the full picture

python
from aiss.exceptions import InvalidChainError

researcher_events = aiss.load_events("researcher_01")
writer_events = aiss.load_events("writer_01")

try:
    aiss.verify_chain(researcher_events)
    print("researcher_01: chain intact")
except InvalidChainError as e:
    print(f"researcher_01: chain compromised — {e}")

try:
    aiss.verify_chain(writer_events)
    print("writer_01: chain intact")
except InvalidChainError as e:
    print(f"writer_01: chain compromised — {e}")

# The interaction_hash appears in both chains — cross-verifiable
# without a server, without PiQrypt infrastructure.

vs LangSmith / CrewAI traces

CrewAI's built-in tracing and LangSmith both provide excellent observability
within their respective frameworks. The distinction isn't observability —
it's falsifiability.

A trace tells you what happened. A co-signed chain proves it, offline,
to a third party who has no reason to trust you. The interaction_hash
is the same in both agents' memories. Change one side — the other breaks.
These are complementary tools, not competing ones.

Multi-agent sessions: N agents, N×(N-1)/2 handshakes

For larger crews, PiQrypt's AgentSession handles the pairwise handshakes
automatically:

session = aiss.AgentSession(
    agents=[
        researcher_id["agent_id"],
        writer_id["agent_id"],
        reviewer_id["agent_id"]
    ]
)
# 3 agents → 3 pairwise handshakes established
# Every cross-agent interaction is now co-signed

This scales to cross-framework sessions — a CrewAI researcher, an AutoGen
analyst, an Ollama local model — all in the same session, all with
cryptographic proof of every handoff.

The principle

CrewAI handles orchestration — who calls what, in what order, with what tools.
PiQrypt handles proof — that it happened, exactly as described, and that
neither party can deny it.

Both are necessary. Neither replaces the other.

Part 1: How I added cryptographic audit trails to any CrewAI crew in 3 lines

Part 3 (next): Watch your CrewAI agents in real-time with PiQrypt Vigil

GitHub: github.com/piqrypt/piqrypt
pip install piqrypt
Protocol spec (MIT): github.com/piqrypt/aiss-standard
https://github.com/PiQrypt/piqrypt/blob/main/docs/A2A_HANDSHAKE_GUIDE.md
https://github.com/PiQrypt/piqrypt/blob/main/docs/A2A_SESSION_GUIDE.md

How I added cryptographic audit trails to any CrewAI crew in 3 lines

PiQrypt — Mon, 13 Apr 2026 17:31:16 +0000

Your CrewAI crew is running in production. It researches, writes, reviews, decides.
It produces results. But if someone asks you what exactly happened — which agent
ran which step, in what order, and that nothing was altered after the fact —
you don't have a cryptographic answer. You have logs.

Logs can be faked. A cryptographic chain cannot.

The problem with logs

When your crew produces a result, your logs record what happened. But they're
append-only text files — there's no structural guarantee that they haven't been
modified. There's no signature. There's no way to prove, to a third party, that
event B actually followed event A and that neither was tampered with.

This doesn't matter much for a weekend project. It matters a lot once you're in
production, under an audit, or working in any regulated context (EU AI Act Art.12,
MiFID II, HIPAA).

The fix: 3 lines

pip install piqrypt
from piqrypt.bridges.crewai import AuditedAgent as Agent

researcher = Agent(
    role="Researcher",
    goal="Find competitive pricing data",
    backstory="Expert at finding and analyzing market data.",
    agent_name="researcher_01"
)

That's it. AuditedAgent is a drop-in replacement for CrewAI's Agent.
Your crew definition doesn't change. Your tasks don't change.
Your tools don't change.

What changes: every action this agent takes is now an Ed25519-signed,
hash-chained event stored locally.

What that actually means

Each event contains a previous_hash pointing to the hash of the event before it.
The structure looks like this:

{
  "version": "AISS-1.0",
  "agent_id": "researcher_01_xK9mP...",
  "timestamp": 1744531200,
  "nonce": "550e8400-e29b-41d4-a716-446655440001",
  "payload": {
    "event_type": "tool_call",
    "tool": "web_search",
    "input": "competitor pricing Q1 2026"
  },
  "previous_hash": "sha256:a3f7e8c9b1d5f2...",
  "signature": "base64:RXZlbnQ..."
}

If someone modifies any event after the fact — even a single byte — every
previous_hash downstream breaks. The tampering is detectable instantly,
offline, with no server needed.

Verification:

import piqrypt as aiss

events = aiss.load_events("researcher_01")
result = aiss.verify_chain(events)
# Chain verified — 47 events, 0 anomalies, trust_score: 0.97

A full crew example

from crewai import Crew, Task
from piqrypt.bridges.crewai import AuditedAgent as Agent

researcher = Agent(
    role="Researcher",
    goal="Find competitive pricing data",
    backstory="Expert at finding and analyzing market data.",
    agent_name="researcher_01"
)

writer = Agent(
    role="Writer",
    goal="Produce a pricing analysis report",
    backstory="Turns raw data into clear executive summaries.",
    agent_name="writer_01"
)

research_task = Task(
    description="Research competitor pricing for product X",
    agent=researcher
)

write_task = Task(
    description="Write a pricing analysis based on the research",
    agent=writer
)

crew = Crew(
    agents=[researcher, writer],
    tasks=[research_task, write_task]
)

result = crew.kickoff()

Every action from researcher_01 and writer_01 is independently hash-chained
and signed. Two separate cryptographic histories. Nothing else changed.

Monitoring with Vigil

pip install piqrypt also installs Vigil — a local monitoring dashboard that
launches on http://localhost:8421.

from vigil import start_vigil
start_vigil()

Vigil shows you VRS (Verifiable Risk Score) in real time, chain health per agent,
and raises CRITICAL alerts if anomalies are detected. No external dependency.
No data leaves your machine.

What this is and what it isn't

PiQrypt doesn't decide whether your agents make good decisions. It doesn't
evaluate output quality. The trust score is a measure of chain integrity,
not decision quality — fully deterministic, no ML involved.

It also doesn't replace legal counsel for compliance. What it does: provide the
cryptographic infrastructure that makes your agent's history tamper-evident and
verifiable by any third party, offline, without PiQrypt infrastructure.

The MIT core (AISS protocol) is open source. The signing primitives are standard:
Ed25519 (RFC 8032), SHA-256 (NIST FIPS 180-4), RFC 8785 canonicalization.
No proprietary black box.

Get started

pip install piqrypt

GitHub: github.com/piqrypt/piqrypt
Protocol spec (MIT): github.com/piqrypt/aiss-standard
Site: piqrypt.com aiss-standard.org

Next article in this series: multi-agent accountability — what happens when your
Researcher passes output to an Analyst and you need cryptographic proof of the
exchange itself, not just each agent's individual history.

# Your AI Agents Are Talking — But Can You Prove What They Said?

PiQrypt — Thu, 09 Apr 2026 12:41:56 +0000

Your AI Agents Are Talking — But Can You Prove What They Said?

AI agents are no longer “helpers.”

They move money, make decisions, and talk to each other.

If you have at least two agents, you’re already in a multi‑agent system — whether you planned for it or not.

PiQrypt is an open‑source trust layer that ensures every interaction between your agents is cryptographically verifiable.

Even if your agents change, your LLMs evolve, or your infrastructure migrates — PiQrypt stays as the immutable proof layer on top.

The gap nobody talks about

Modern AI stacks are incredibly powerful:

LLMs: OpenAI, Anthropic, Mistral, DeepSeek, local models.
Agent frameworks: LangChain, CrewAI, AutoGen, custom agents.
Observability tools: logs, traces, dashboards.

They all share a blind spot:

“They can show you what happened — but they can’t prove it.”

Logs can be modified.

Traces aren’t cryptographic.

And when agents interact, there’s no shared, verifiable record of that interaction.

When something goes wrong:

Which agent made the decision?
In what order?
Based on which interaction?
Can you prove it to someone outside your system?

Most systems today can’t.

Agents don’t just need to connect — they need to agree

When two agents interact, there are actually two problems:

How do they communicate?
How do they prove they communicated?

Today’s A2A‑style protocols (Agent2Agent, AI‑to‑agent handshakes, and custom flows) mainly solve the first.

PiQrypt solves the second — with cryptographic proof around agent‑to‑agent interactions.

“Agents need a handshake — not just a connection.”

Enter PiQrypt: co‑signed interactions with cryptographic memory

PiQrypt is an open‑source trust layer that sits between your agents and your memory / logs. It’s LLM‑agnostic, framework‑agnostic, and infrastructure‑agnostic:

Works with any LLM (OpenAI, Anthropic, Mistral, DeepSeek, local).
Integrates with any framework (LangChain, CrewAI, AutoGen, or your own).
Independent of your storage, logs, MLflow, or cloud provider.

Every interaction becomes:

Co‑signed by the participating agents,
Anchored in a hash‑chained audit trail,
Part of a verifiable, multi‑agent session.

This is powered by AISS (Agent Identity and Signature Standard) and built on top of PCP (Proof of Continuity Protocol) — an open protocol specification for agent‑to‑agent collaboration, with PiQrypt as the reference implementation.

How the A2A handshake works conceptually

PiQrypt’s A2A handshake is a short, peer‑to‑peer protocol used to:

Discover other agents (via registry or direct),
Authenticate both agents,
Collaborate with cryptographic proof,
Audit all interactions, stored in both agents’ audit trails.

Here’s how it looks at the protocol level:

Each agent generates an Ed25519 keypair.
Agents exchange public keys (via your agent bus, API, WebSocket, or A2A‑style transport).
Every agent pair performs a co‑signed handshake:
- Both sign the fact that “Agent X and Agent Y have agreed to talk.”
- The handshake is appended to each agent’s hash‑chained memory.

from aiss.a2a import initiate_handshake, accept_handshake, verify_handshake
from aiss.crypto import ed25519
from aiss.identity import derive_agent_id

# Agent A
priv_a, pub_a = ed25519.generate_keypair()
agent_a = derive_agent_id(pub_a)

# Agent B
priv_b, pub_b = ed25519.generate_keypair()
agent_b = derive_agent_id(pub_b)

# 1. Agent A initiates handshake
handshake = initiate_handshake(
    priv_a,
    agent_a,
    agent_b,
    payload={
        "intent": "data_sharing",
        "scope": "market_analysis",
        "terms": "50/50 split"
    },
    expires_in=3600  # 1h timeout, anti‑replay
)

# 2. Send to Agent B
# ...

# 3. Agent B accepts
response = accept_handshake(
    priv_b,
    agent_b,
    handshake,
    counter_payload={
        "agreed": True,
        "conditions": "Data encrypted in transit"
    }
)

# 4. Verify (both agents)
is_valid = verify_handshake(response, {
    agent_a: pub_a,
    agent_b: pub_b
})

print(f"Handshake valid: {is_valid}")

Thanks to piqrypt-session-multi-ai-agents, this is packaged as an AgentSession that creates a shared session across all agents before a single action is taken.

From handshake to verifiable sessions

Here’s a minimal example with three agents: planner (LangChain), executor (AutoGen), and reviewer (CrewAI). All frameworks, one session.

from piqrypt.session import AgentSession
import piqrypt as aiss

# Generate keypairs
planner_key, planner_pub = aiss.generate_keypair()
executor_key, executor_pub = aiss.generate_keypair()
reviewer_key, reviewer_pub = aiss.generate_keypair()

# Define agents
session = AgentSession(agents=[
    {"name": "planner",   "agent_id": aiss.derive_agent_id(planner_pub), "private_key": planner_key, "public_key": planner_pub},
    {"name": "executor",  "agent_id": aiss.derive_agent_id(executor_pub), "private_key": executor_key, "public_key": executor_pub},
    {"name": "reviewer",  "agent_id": aiss.derive_agent_id(reviewer_pub), "private_key": reviewer_key, "public_key": reviewer_pub},
])

# 1. Start: all pairwise A2A handshakes are recorded
session.start()

# 2. Stamp events in the session
session.stamp("planner", "task_delegation", {"task": "rebalance_portfolio"}, peer="executor")
session.stamp("executor", "order_executed", {"order_id": 42, "price": 182.5, "quantity": 100}, peer="reviewer")
session.stamp("reviewer", "review_approved", {"approved": True})

# 3. Later: export and verify offline
session.export("trading‑session‑audit.json")

# That audit is:
# - signed by each agent,
# - co‑signed by every interaction,
# - readable and verifiable without your production stack.

From this moment on:

Every session.stamp(agent_name, event_type, payload, peer=...) is signed by the acting agent.
It’s anchored in the shared, hash‑chained session.
It’s reflected in every agent’s memory, with a shared interaction_hash.

“Same interaction. Two memories. One verifiable truth.”

Trust scores: how much you can rely on a session

PiQrypt doesn’t stop at proof. For every session, it computes:

VRS (Vulnerability Risk Score): a risk metric based on agent behavior, anomalies, and policy flags.
Trust score (0–1): how “safe” the agent’s history and current session are.
TrustGate decision: ALLOW, REQUIRE_HUMAN, or BLOCK, enforced at runtime with signed proof of every decision.

Example:

result = piqrypt.verify(
    signature=agent_event.signature,
    chain=agent_event.chain,
    context={"agent_id": "pq1_planner_a3f8", "action": "portfolio_rebalance"}
)

print(f"trust_score: {result.trust_score:.4f}")   # → 0.9987
print(f"decision: {result.decision}")             # → ALLOW

You can block risky actions, require human approval, or allow automatically, all based on verifiable data.

Stack‑agnostic by design

PiQrypt is built to be truly agnostic:

LLMs: OpenAI, Anthropic, Mistral, DeepSeek, local models.
Agent frameworks: LangChain, CrewAI, AutoGen, or any custom stack.
Cloud / infra: Independent of your storage, logs, MLflow, Application Insights, or LangSmith.

“Your agents can change. Your infrastructure can change. Your trust layer should not.”

PiQrypt’s A2A handshake and PCP‑backed audit trail work over any transport (API, message bus, A2A style, or custom protocol). The registry can be centralized, distributed, or even DHT‑based in the future.

Why this matters in production

If you’re building:

Multi‑agent workflows (planner → executor → reviewer → auditor).
Agents that communicate across boundaries (company ↔ partner, SaaS ↔ local).
Compliance‑sensitive applications (finance, healthcare, legal, etc.).

…then an A2A handshake with cryptographic trust scoring is no longer optional.

With PiQrypt, you get:

Cryptographic identity for every agent.
Co‑signed, hash‑chained handshakes for every session.
Session‑anchored events that are verifiable offline, across frameworks.
Numeric trust scores integrated into your governance and policy layer.

Getting started

Install PiQrypt and the A2A‑ready session module:

   pip install piqrypt piqrypt-session-multi-ai-agents

Follow the A2A‑focused guides:

docs/A2A_HANDSHAKE_GUIDE.md
docs/A2A_SESSION_GUIDE.md
QUICK-START.md (A2A handshake section).

Run the 3‑agent demo (planner → executor → reviewer) and experiment with verify() + trust_score on your own event chains.

From observability to verifiability

We’ve spent years building observability for software systems.

Now, AI needs the same — but stronger:

“Not just visibility.

Proof.”

Your agents already talk.

The real question is:

“Can you prove what happened between them?”

Right now, most systems can’t.

PiQrypt does.

PiQrypt is the A2A handshake your agents never knew they needed.

Nothing ever disappears, and nothing appears out of nowhere — only what’s cryptographically agreed upon.

You can check out the full reference implementation on [GitHub/PiQrypt]
https://github.com/PiQrypt/piqrypt and try your first A2A handshake today.

Why AI agents need cryptographic memory — and how to add it in one line

PiQrypt — Fri, 03 Apr 2026 09:29:21 +0000

The problem nobody talks about
AI agents can act. They can call APIs, write files, execute code, make decisions.
But can they prove what they did?
Logs can be edited. Timestamps can be faked. Events can be reordered silently.
There's no equivalent of Git, TLS, or OAuth for agent behavior over time.
What cryptographic memory looks like
Every action becomes a signed, hash-chained event:

Who acted — deterministic Ed25519 agent identity
What was decided — signed payload
When — tamper-evident sequence
Nothing missing — fork detection catches silent deletions

Verifiable offline. No server. No central authority.
One line with LangChain
pythonfrom piqrypt_langchain import PiQryptCallbackHandler

handler = PiQryptCallbackHandler(agent_name="my_agent")
llm = ChatOpenAI(model="gpt-4o", callbacks=[handler])

Every action is now signed & hash-chained

handler.export_audit("audit.json")
The standard behind it
This is built on AISS — Agent Identity and Signature Standard — an open protocol.
The RFC is public. The spec is implementable by anyone.
TCP/IP secured communication. TLS secured it. OAuth made it delegable.
AISS is that primitive for autonomous agent trust.
Try it
bashpip install piqrypt[langchain]
📦 PyPI : piqrypt
🔗 LangChain Hub : hub.langchain.com/piqrypt/piqrypt-audited-agent
📖 RFC : github.com/PiQrypt/piqrypt/blob/main/docs/RFC_AISS_v2.0_narrative.md
Happy to discuss the threat model, the crypto choices, or the RFC in the comments. 👇