Every AI agent decision, in one signed chain you can search, replay, and verify.
Etch records every AI agent decision as a signed event: the prompt, the context, the tools called, the outcome. When production breaks, replay the exact chain. When a reviewer asks six months later, the same record verifies on their laptop against pinned keys. Nothing depends on Etch staying online.
Debug your agents like you debug your services. Cryptographic audit comes along for free.
ijson parse, no vendor dependency.
Numbers from the Etch hosted control plane, updated on request. Aggregate only. Never per-tenant reasoning, session, or event content.
Public OSS traction on world-model-mcp, the memory layer Etch is built on. Numbers pulled daily from PyPI + GitHub. No user data, no tracking.
Updated daily. Snapshot generated 2026-08-02T10:00:27 UTC. PyPI stats from pypistats.org; GitHub stats from api.github.com.
One authenticated audit chain. Three surfaces so developers, auditors, and reviewers each get the tool that fits their job.
Signatures prove authorship. Hashes only prove order.
A hash chain detects tampering but does not tell you WHO signed what. An authenticated audit chain does both. Every epoch is Merkle-hashed AND signed under a key the auditor can pin.
| Etch (signed) | Hash-only log | Plain log | |
|---|---|---|---|
| Signature scheme | Hybrid Ed25519 + SLH-DSA-SHA2-128f (FIPS 205) | None (hash only) | None |
| Post-quantum ready | Yes (SLH-DSA is NIST PQC) | No | No |
| Offline reference verifier | Yes (etch-verify, streaming) | Vendor-specific | No |
| Framework mapping (EU AI Act / SOC 2 / ISO) | Article + control IDs cited | Ad hoc | None |
| Signed decision receipts | Yes (per epoch) | No | No |
| Human annotation in-chain | pin_annotation MCP tool | No | No |
| Shareable auditor URL (no login) | Yes (expiring share tokens) | No | No |
The audit primitive we are building.
Etch is not a product category. It is infrastructure that sits under whatever agent operating system, memory framework, or compliance suite you already run. These four principles are what "sit under" means in practice.
Etch is infrastructure that sits UNDER agent operating systems, memory frameworks, and compliance suites. We do not compete for the workspace. We witness what the workspace does. Every existing agent stack can adopt Etch without giving up their storage, their orchestrator, or their UI.
Every event is committed to a SHA-256 Merkle chain (order integrity). Every epoch is signed with a hybrid Ed25519 + SLH-DSA-SHA2-128f envelope (authorship + post-quantum future-proofing per FIPS 205). Verifiable with pinned public keys, no round-trip to our servers.
Every closed epoch is anchored to two independent public logs: Sigstore Rekor (within hours) and Bitcoin OpenTimestamps (committed to a Bitcoin block header, confirmation within 6-12 hours). Rewriting a signed epoch would require overpowering the hashing power of the Bitcoin network. Economically infeasible.
Auditors run the offline etch-verify CLI against the manifest on their own laptop. A browser-side chain-integrity check runs SHA-256 Merkle math via WebCrypto. Public-key fingerprints are pinnable. If Etch vanishes tomorrow, every audit trail written before we go dark still verifies against Sigstore Rekor entries and Bitcoin block headers.
Your AI agent just approved a 20% discount that violated policy. Six months later, a regulator asks why. Your CRM shows the final price. Etch shows the exact context the agent saw at that moment, the policy version, the exception route, the precedent it cited, the approver on the chain, cryptographically sealed so no one, including you, can rewrite it after the fact.
Wire your agent through Etch without changing your framework.
// Your agent already has a decision. Record it through the MCP client. await etch.recordEvent({ event_type: "decision", session_id: "approval-bot-v2", entities: ["account/acme-corp", "policy/discount_v3.2"], description: "Approved 20% discount; healthcare exception per precedent Q3-2025", success: true }); // The event is Merkle-hashed, chained to the previous epoch, hybrid-signed, // and published to your transparency log automatically. No cryptography // knowledge required by your agent code.
Works with any MCP-aware client, Claude Code, Cursor, custom orchestration. TypeScript SDK on npm, Python core on PyPI.
asserted_by, confirmer,
confirmation_state, evidence_type,
last_decay_at, influence_state, is
documented in an open-access technical report on Zenodo.
Coach-Player: your agent proposes, Etch verifies.
A Player agent drafts a decision. A Coach independently requeries Etch for precedent, walks the Merkle proof, checks the hybrid signature, and only then approves. The Coach never trusts the Player's summary. It reverifies against a signed ledger every time.
// Coach receives a Player proposal and reverifies against Etch. const precedent = await etch.queryFact({ q: proposal.contextQuery, limit: 5 }); const chainOk = await etch.verifyRecent(); // walks Merkle + sig if (!precedent.length || !chainOk) return escalate(proposal); if (matches(proposal, precedent)) return approve(proposal, precedent); return escalate(proposal);
A reference implementation ships with the hosted service:
examples/coach_player_example.py. Wire it into
LangGraph, CrewAI, plain async, whatever your Player runs on.
Three guarantees, cryptographically enforced.
Verifiable non-tampering
Auditors pin your public-key fingerprints once. Every past epoch is verifiable offline. Retroactive edits are cryptographically detectable.
Split-view resistance
Two auditors comparing signed heads catch any operator serving different histories to different observers.
Post-quantum coverage
Hybrid signature envelope. Both classical and post-quantum signatures are required at verify. See P.02 above for the full primitive spec.
Five deterministic steps. No trust in the operator required.
-
1
Agent writes an event
Your agent records an event through the MCP tool. Etch appends it to a per-project signed audit chain with the source, tool, and session that wrote it.
-
2
Epoch closes and is signed
When the epoch threshold hits, entries are Merkle-hashed, chained to the previous epoch's root, and hybrid-signed with your KMS-managed keys.
-
3
Signed epoch enters the transparency log
Etch mirrors the signed epoch into a public, chained transparency log at a stable URL you publish to your auditors.
-
4
Auditor pins fingerprints once
At pilot onboarding, your compliance auditor records your public-key fingerprints in a signed compliance repository or on paper.
-
5
Verifier runs offline forever after
etch-verifywalks the transparency log, verifies each chain hash, and confirms the hybrid head signature against pinned keys. No network access to Etch required.
Ready to audit what your agents actually decide?
Start free, no credit card. One project. Sign up in 30 seconds. Provision your keys in one click.
Sign up→