Skip to main content
Glama
Sovereign Agent Logbook

Sovereign Agent Logbook

by Delfen-com

Sovereign Agent Logbook

Every AI agent needs a logbook. Yours should stay in Europe.

An open-source, tamper-evident logbook for AI agents. It records every action, tool call and human approval — who, what, why, approved by whom, with what outcome — in an append-only, hash-chained file on your own server. It works with any model (Mistral, GPT-NL, Llama, Claude, GPT…) because it speaks the open Model Context Protocol.

CI Licence: Apache-2.0 Status: v0.1 — early, working, tests passing

v0.1 is a working skeleton, not a finished product. It logs, chains, masks secrets, verifies and exports, and every claim on this page has a test behind it. What it does not do yet is listed honestly in ROADMAP.md.

Why

Since 2 August 2026 the EU AI Act asks deployers of high-risk AI systems for logging, human oversight and incident reporting. Autonomous agents make that harder: one task is ten tool calls, and when something goes wrong nobody can reconstruct which call did what, on whose approval.

Most tools for this live inside a US cloud platform or are built for one model vendor. If you run a sovereign setup — an open-weight model on your own hardware — there is nothing small and neutral to drop in. This is that thing.

Related MCP server: AgentAudit MCP

What you get

  • A tamper-evident log. Each event carries the hash of the previous one. Change, insert, remove or reorder a line and logbook verify tells you exactly where. (How, in 60 lines)

  • Any model, any host, or no cloud at all. Four MCP tools: log_event, verify_logbook, recent_events, export_logbook.

  • Secrets masked before writing. Keys that look like passwords, tokens, API keys, IBANs or BSNs are replaced with ***masked*** before hashing.

  • Zero outbound network, proven. A test forbids every socket connection at OS level and runs the full cycle anyway. (tests/test_no_network.py)

  • Audit-ready export. JSON and CSV your DPO or auditor can read without this tool.

  • An open format. SPEC.md is the log format, separate from the code, Apache-licensed, so other tools can write it too.

  • A Skills pack that teaches any agent when to log, what to write and when to stop and ask a human. (skills/sovereign-agent-logbook/SKILL.md)

Five-minute install

pip install git+https://github.com/Delfen-com/sovereign-agent-logbook

Point your MCP-capable agent host at the server over stdio. For Claude Desktop / Claude Code, Cursor, Continue, or any host with an mcpServers block:

{
  "mcpServers": {
    "logbook": {
      "command": "sovereign-agent-logbook",
      "env": { "LOGBOOK_PATH": "/var/lib/logbook/agent.jsonl" }
    }
  }
}

Or run it as a service on your own box with Docker:

docker build -t sovereign-agent-logbook .
docker run -d --name logbook \
  -p 127.0.0.1:8765:8765 \
  -v logbook-data:/data \
  sovereign-agent-logbook
# MCP endpoint: http://127.0.0.1:8765/mcp   (put TLS in front for anything beyond localhost)

Then, at any time, as a human:

logbook --path /var/lib/logbook/agent.jsonl verify
logbook --path /var/lib/logbook/agent.jsonl export --format csv > audit.csv
logbook --path /var/lib/logbook/agent.jsonl tail --limit 10

What an event looks like

{"spec":"0.1","seq":42,"id":"…","ts":"2026-11-05T20:41:03.123456+00:00",
 "prev_hash":"9f2c…","hash":"3a1b…",
 "agent_id":"invoice-bot","model":"mistral-small-4",
 "action":"pay_invoice","arguments":{"amount":1250,"iban":"***masked***"},
 "reason":"Invoice 2026-118 matches PO 4471 and is under the auto-approval limit",
 "approval":"auto","approved_by":null,"approval_rule":"pay-under-2000-matched-po",
 "outcome":"success","result_summary":"Paid via bank API, ref 88213",
 "run_id":"task-7f3e","tags":["finance"]}

Field meanings are normative in SPEC.md.

Trust: no black box

What we promise

How you can check it yourself

Tamper-evident

Edit any line of a logbook file, run logbook verify

No outbound network

tests/test_no_network.py, and the Dockerfile has no network tooling

Tests are public and run on every change

The CI badge above links to every run

We say what it does not protect against

THREAT-MODEL.md

We say which AI Act articles it helps with, and which it does not

docs/ai-act-mapping.md

The format outlives the software

SPEC.md, Apache-2.0

Security issues have a process

SECURITY.md

Decisions are recorded

ROADMAP.md, CHANGELOG.md

Not tied to one platform

GitHub is where most developers look, so this is the working repository. An identical mirror on EU-hosted infrastructure is planned so that the code never depends on a single platform; the target is being chosen and will be recorded in ROADMAP.md. Until then, git clone gives you a complete copy — that is the point of git.

Hosted version

If you would rather not run a server, a hosted version on EU-only infrastructure (Hetzner, Germany / Scaleway, France) with retention policies, daily signed anchoring of the chain and a monthly audit export is planned. Register interest at delfen.ai.

Licence

Apache License 2.0. Built in the Netherlands by Delfen. Contributions welcome — see CONTRIBUTING.md.

Available Tools

4 tools
export_logbookB

Export the full logbook as JSON or CSV text that an auditor can read without this tool.

NameRequiredDescriptionDefault
formatNojson

Output Schema

NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden and only says the export is complete and auditor-readable. It omits whether the operation is read-only, whether exports are size-limited or paginated, and whether sensitive data is included, leaving key behavioral traits unstated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One front-loaded sentence with no filler; the verb, resource, formats, and consumer are all stated immediately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need not be explained, and the single parameter is simple. However, for an export tool with no annotations, the description should say more about scope and operational limits to be complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single format parameter has an enum of json/csv and a default, so the schema is largely self-explanatory despite 0% description coverage. The description confirms both formats exist but adds no detail on format-specific differences or defaults beyond what the schema shows.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Export the full logbook") plus the supported output formats, which distinguishes it from siblings like log_event and verify_logbook. It doesn't explicitly name what it is not, but the action is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The auditor-facing framing implies when to use it (producing a human-readable record), but there is no explicit when-to-use or when-not-to-use guidance relative to verify_logbook or recent_events. The agent must infer the selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

log_eventA

Record one agent action in the logbook.

Who: agent_id (your agent's stable name) and model (e.g. "mistral-small-4"). What: action (the tool or operation) and arguments (secrets are masked). Why: reason — one plain sentence. Approval: "human" with approved_by, "auto" with approval_rule, or "none". Outcome: "pending" when logging before the action; log again with "success", "error" or "escalated" after it. Returns the stored record including its seq and hash.

NameRequiredDescriptionDefault
tagsNo
modelYes
actionYes
reasonNo
run_idNo
outcomeNopending
agent_idYes
approvalNonone
argumentsNo
approved_byNo
approval_ruleNo
result_summaryNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full behavioral burden and does disclose two non-obvious traits: arguments are stored with secrets masked, and the call returns the stored record including seq and hash. It does not say whether the log is append-only, whether entries can be amended or deleted, or what happens to orphaned "pending" rows, which matters for an audit tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded verb+resource sentence, then a Who/What/Why/Approval/Outcome skeleton that maps directly onto the schema fields. Every line adds a distinct constraint or example; nothing is repeated from the title or padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 12-parameter mutation tool with zero annotation coverage this is substantially complete: it explains the two-phase pending-then-outcome pattern, the approval taxonomy, secret masking and the returned identifiers, and an output schema exists so return values need no further prose. The remaining gap is the unexplained tags, run_id and result_summary fields plus no note on write permissions or log immutability.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description has to compensate, and it does for most fields: agent_id is defined as the agent's stable name, model gets an example value, reason is constrained to one plain sentence, and approved_by/approval_rule are tied to their respective approval modes. Three parameters (tags, run_id, result_summary) get no explanation anywhere, which keeps this below a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Record one agent action in the logbook" states a precise verb (record), a precisely scoped resource (one agent action) and the destination (logbook). It is immediately distinguishable from siblings verify_logbook, recent_events and export_logbook, which read, verify or export rather than append.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The Outcome line gives real workflow guidance: log with "pending" before acting, then log the same action again with success/error/escalated. The Approval line similarly prescribes which approval mode pairs with which field. It never states when not to log, or why one would pick this over recent_events, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

recent_eventsC

Return the most recent events (default 20) for a quick look.

NameRequiredDescriptionDefault
limitNo

Output Schema

NameRequiredDescription
resultYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, yet it discloses almost nothing beyond the default count. It does not state the sort order (newest first?), whether results are truncated silently, whether it is read-only, or any permission or rate considerations; an output schema exists, which covers return shape but not runtime behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short sentence with the key noun and default front-loaded and no filler words. It is efficient, though its brevity edges toward under-specification rather than surplus wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-optional-parameter read tool with an output schema, the description is close to adequate on shape but leaves real gaps: no ordering, no note about what happens when fewer than 'limit' events exist, and no signal at all about where this sits relative to its three siblings. With no annotations to fall back on, more context was needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single 'limit' parameter, so the description would need to compensate. It only restates the default value of 20, which the schema already declares via 'default': 20, and never explains what limit counts or how it interacts with the 'most recent' ordering.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Return the most recent events') with a scope qualifier ('most recent') and default count, so an agent knows it is a read of recent entries. It does not name or distinguish itself from the siblings log_event, verify_logbook, and export_logbook, leaving the differentiation implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'for a quick look' is the only usage guidance and is a vague intent hint rather than an explicit when-to-use rule. There is no statement about when to prefer export_logbook or verify_logbook instead, and no mention of prerequisites or ordering guarantees.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_logbookA

Check the whole logbook's hash chain. Returns ok, event count and any problems in plain English.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does disclose a key behavior: it returns 'ok, event count and any problems in plain English', implying a non-mutating audit whose value is human-readable diagnostics. It omits other behavioral traits an agent needs, such as whether the call is read-only guaranteed, how expensive a full-chain scan is on a large logbook, or what happens on partial corruption.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with zero filler, the action and scope front-loaded and the result shape following immediately. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the description need not explain return values, and with zero parameters there is little surface area to cover. The remaining gap is the absence of cost/scale or read-only context for a potentially full-logbook scan, which for a simple tool is minor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate beyond what the empty schema already conveys. The base score for a parameterless tool applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Check') and a precise resource and scope ('the whole logbook's hash chain'), which lets an agent distinguish this integrity check from the sibling writers/readers (log_event, recent_events, export_logbook) without opening any schema. It stops short of explicitly naming a sibling or contrasting scope, which keeps it from a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the mention of checking the 'whole' chain suggests a full-integrity audit rather than an incremental read, but there is no explicit when-to-use, when-not-to-use, prerequisites or alternative-tool routing. An agent can infer the purpose but gets no decision rules.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.1.0
    • First observedexport_logbook
    • First observedlog_event
    • First observedrecent_events
    • First observedverify_logbook

TDQS

A3.6/5.0

Scored across 4 tools

Disambiguation5/5

Each tool maps to a distinct operation on the logbook: log_event writes, recent_events reads a quick tail, verify_logbook checks hash-chain integrity, and export_logbook produces an auditor-facing dump. The write/read/verify/export split is unambiguous, and the only mild adjacency (recent_events vs export_logbook) is clearly differentiated by scope and format.

Naming Consistency4/5

All names use consistent snake_case and are built around the shared noun 'logbook'/'event'. Three tools follow a verb_noun pattern (log_event, verify_logbook, export_logbook), but recent_events deviates into an adjective_noun form, a minor inconsistency in an otherwise predictable scheme.

Tool Count5/5

Four tools is compact but well-matched to an append-only audit log with verification and export needs. Each tool earns its place: write, inspect, verify, and hand off to a human auditor, with no redundant or filler operations.

Completeness4/5

The core lifecycle of an audit logbook (record, inspect, verify integrity, export) is covered, and outcome re-logging handles status transitions without a separate update tool. Minor gaps remain: recent_events caps at a small tail with no paging or filtering by agent, seq, or time range, so the only way to traverse full history is the export dump.

Maintenance

ActivityMaintained
ResponsivenessNo recent community issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Provides an immutable, tamper-evident audit trail for AI agents, enabling event logging with cryptographic chaining, search, verification, and statistics.
    3
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Provides permission gates and tamper-evident audit logging for AI agent tool executions, with declarative policies, consent ladders, and hash-chained verification.
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Tamper-evident audit trail for AI agent tool calls. Cryptographically signed, hash-chained records that prove what your agents did.
    3
    19 npm
    MIT