The loop is attest, measure, verify: a sealed artifact fixes what is allowed, each measurement against it is signed, and the exported bundle carries the permitted and denied calls with their proofs. Offline verification is what makes that evidence worth anything to somebody outside your organisation.
A runtime governance layer for agents. It attests a subject into a sealed policy artifact, measures the running state against it, and produces signed receipts and bundles that verify without a network.
- attest_subject — attests a subject and seals a policy artifact, loading it into the portal
- measure_integrity — measures subject state against the sealed reference, signing a receipt for every measurement
- measure_behavior — behavioural patterns such as unauthorized tools, rate violations and forbidden sequences, detective-only by default
- delegate_to_subagent — derives a constrained artifact for a sub-agent, whose scope can only narrow, never widen
- revoke_artifact — revokes an active artifact mid-session, terminating the portal on the next measurement
- init_chain, verify_chain and get_chain_events — the continuity chain started from a genesis event, verified, and read back
- generate_evidence_bundle and verify_bundle_offline — export the permitted and denied tool-call receipts with Merkle proofs, and verify a bundle with no network involved
- request_claim and list_claims — available claims with their sensitivity levels, and disclosure requests that substitute automatically when denied
- get_receipts, get_server_info and get_portal_state — the signed receipts, the server's public keys, and the current portal and enforcement state
Npx and a Node runtime; the documented launch line takes no keys and it runs as a local stdio process. Verifying a bundle needs nothing at all — the reference verifier ships in the repository.
One command — npx -y @attested-intelligence/aga-mcp-server