Open source · Identity & attestation for AI agents

Never trust
the agent.
Verify it.

TrustX gives every AI agent a passport and a tamper-proof log of everything it does. Anyone can verify what an agent actually did, without trusting whoever ran it. Three lines of Python. No blockchain. No vendor lock-in.

See it catch a forgery Read the code
88% of enterprises had an AI agent security incident last year Industry survey, 2026
33% have no agent audit trail at all Industry survey, 2026
Aug 2 EU AI Act enforcement begins, 2026 Regulation (EU) 2024/1689
agent.py
from trustx import TrustX

tx = TrustX.init(passport="passport.json")

# every call is now signed + chained
purchase = tx.wrap("purchase", purchase_tool)

purchase(amount_cents=18000, item="chairs")
# → adr #2 signed, chained, verifiable

$ trustx verify log.db
✓ 6 records · chain intact · signatures valid
The problem

Agents act on your behalf.
Nobody can prove what they did.

An AI agent books travel, moves money, files documents, emails customers. When something goes wrong, the only record is a log file the operator controls and could have edited. That is not evidence. It is a claim.

01 — THE DEAL BLOCKER

"Prove your agent didn't do that"

Enterprise procurement asks how they can verify what your agent accessed and did. The honest answer today is "here are our logs, trust us." Deals stall in security review for months.

02 — THE AUDIT GAP

Logs are not evidence

A plain log can be edited after the fact and nobody can tell. No signature, no chain, no way for an outside party to detect a deleted line or a changed number.

33% of agent deployments keep no audit trail at all
03 — THE DEADLINE

Regulation arrives August 2

EU AI Act enforcement for high-risk systems begins August 2, 2026, with penalties up to €35M or 7% of global turnover. Auditors will ask for records. Most teams have nothing to hand them.

Regulation (EU) 2024/1689
How it works

Two pieces. Both boring on purpose.

No blockchain, no new trust assumptions, no proprietary format. Standard cryptography that has protected the internet for twenty years, applied to a new problem.

Piece 01

Agent Passport Ed25519 · operator-delegated keys

A signed identity document for each running agent: who it is, who operates it, what it is authorized to do, and when that authorization expires. The operator's root key signs each agent's key, so a verifier can trace any action back to a named, accountable organization.

Piece 02

Attestation Log SHA-256 hash chain · signed records

Every action the agent takes becomes a signed record that includes the hash of the record before it. Change one number in record #2 and every hash after it breaks. Delete a record and the chain has a hole. A third party detects both in milliseconds, without trusting the operator.

What comes out

A portable evidence file

Export any session as a single .trustx.json file containing the passport and every record. Hand it to a customer, an auditor, or a court. They verify it with a public key and zero infrastructure. The proof travels with the claim.

Live demo · real cryptography in your browser

Tamper with the log.
Watch it get caught.

Below is a real signed action log from a purchasing agent with a $500 budget. The hashes are computed with actual SHA-256 and the signatures are real ECDSA, generated in your browser right now. Edit any record and run the verifier.

Verifier
Not yet run
Press verify to check the chain.
Keys generated on page load and never leave your device. Nothing is sent to a server. View source, it is all here.
Integration

Three lines. Any Python agent.

Works with LangChain, CrewAI, AutoGen, the OpenAI and Anthropic SDKs, or a plain function. If it runs in Python, it can be attested.

# 1. install
$ pip install trustx

# 2. issue a passport for your agent
$ trustx passport issue --ontology procurement-agent
✓ passport.json + instance.key written

# 3. wrap your tools
from trustx import TrustX

tx = TrustX.init(passport="passport.json", keyfile="instance.key", db="log.db")

# optional: block actions that break a rule, and attest the block
tx.policy("spend-cap-500", lambda c: c["session"]["spend_cents"] + c["input"]["amount_cents"] <= 50000)

purchase = tx.wrap("purchase", purchase_tool)
purchase(amount_cents=18000, item="chairs") # signed, chained, verifiable

# 4. anyone verifies, no infrastructure needed
$ trustx verify log.db
✓ passport valid · 6 records · chain intact · signatures valid
Threat model

What this proves.
And what it doesn't.

Security products that overclaim get people hurt. Here is the honest boundary, the same one that ships in our README.

Proves

  • A specific, named agent instance produced this record
  • The record has not been modified since it was signed
  • No record was inserted, deleted, or reordered in the chain
  • The operator's root key authorized this agent instance
  • A policy decision was made before the action ran, and what it decided
  • Gaps in the sequence are detectable, so silence is visible

Does not prove

  • That the agent's output was correct, safe, or high quality
  • That the operator recorded every action — an operator can decline to log, though gaps and missing heartbeats make it detectable, not preventable
  • That the underlying tool did what its name says it does
  • Anything about actions taken outside the wrapped functions
Early access

Get the SDK first.

We're onboarding a small group of design partners building agents that touch money, documents, or customer data. You get the SDK, direct support, and influence over the spec.

No spam. We email once when the SDK is ready.