What Did Your Agent Do Last Night?

#ai #security #agents #opensource

You deployed an AI agent. It ran overnight. In the morning, you have no idea what it actually did, why it made those decisions, or whether anyone tampered with the record...

The problem

Everyday AI agents are taking real actions; sending emails, modifying databases, calling APIs, processing payments. When something goes wrong, nobody can produce a provable, tamper-evident record of what happened.

What AgentSeal does

Every action your agent takes is recorded in a cryptographic hash chain. Each entry's hash depends on the previous entry. Modify any record and the entire chain breaks, thus it is immediately detectable and mathematically provable. With this, you can actually prove to your clients that your agent did what it said it did by showing them the action logs.

Set it up in 30 seconds for free. If you use Claude Desktop or Cursor, add this to your MCP config:

{
  "mcpServers": {
    "agentseal": {
      "command": "npx",
      "args": ["-y", "agentseal-mcp"],
      "env": { "AGENTSEAL_API_KEY": "as_sk_..." }
    }
  }
}

Or use the Python SDK:

from agentseal import Seal

seal = Seal(api_key="as_sk_...")
seal.record(
    agent="my-bot",
    action="email:send",
    params={"to": "user@example.com"},
    reasoning="User requested password reset"
)

Every call records what happened, why, and who authorized it. The hash chain links each entry to the last, so any retroactive modification is instantly detectable.

Why now

The EU AI Act requires tamper-evident logging for high-risk AI systems by August 2026. California SB-833 follows in July 2026. The compliance clock is ticking, and most agent frameworks have no audit trail at all.

What's included

Tamper-proof SHA-256 hash chain — each entry cryptographically linked to the previous one
Python SDK and MCP server — works with Claude Desktop, Cursor, and any MCP-compatible host
Dashboard — search, filter, and inspect every action your agents have taken
Chain verification in one API call — POST /v1/verify walks the entire chain and reports integrity

How it works under the hood

When you record an action, AgentSeal computes a SHA-256 hash of the entry content (agent ID, action type, parameters, reasoning, timestamp) combined with the previous entry's hash. This creates a linked chain:

Entry 1 → hash: a1b2c3...
Entry 2 → hash: d4e5f6... (includes a1b2c3)
Entry 3 → hash: g7h8i9... (includes d4e5f6)

Change Entry 2 and its hash changes. But Entry 3 still references the original hash. The mismatch is detected instantly. You can't silently alter history.