AgentSeal provides a tamper-proof audit logging system for AI agents using SHA-256 hash chains, allowing you to cryptographically prove what actions your agents took.
record_action: Log agent actions (e.g., sending emails, writing files, API calls) to an immutable audit trail, capturing agent ID, action type, parameters, reasoning, and authorization info. Each entry is chained cryptographically.
query_actions: Retrieve previously recorded actions, with optional filtering by agent ID or action type, and a configurable result limit.
verify_chain: Cryptographically verify the integrity of the hash chain — for a specific agent or all entries — to detect any tampering or unauthorized modifications.
MCP server for AgentSeal. Tamper-proof audit logs for AI agents, using SHA-256 hash chains.
Every agent action is recorded in a hash chain. With this, you can actually prove to your clients that your agent did what it said it did.
Add to your claude_desktop_config.json:
{
"mcpServers": {
"agentseal": {
"command": "npx",
"args": ["-y", "agentseal-mcp"],
"env": {
"AGENTSEAL_API_KEY": "as_sk_your_key_here"
}
}
}
}Restart Claude Desktop after saving.
Same configuration — add the server with your API key.
Variable | Required | Description |
| Yes | Your API key from agentseal.io |
| No | Custom API base URL (defaults to production) |
Related MCP server: PiQrypt MCP Server
record_actionRecord an agent action to the audit trail. Call this after significant actions to create a cryptographically chained record of what happened and why.
Parameter | Type | Required | Description |
| string | Yes | Identifier for the agent (e.g. |
| string | Yes | What kind of action (e.g. |
| object | No | Details of the action |
| string | No | Why the agent decided to take this action |
| string | No | Who or what approved the action |
Returns a sequence number and SHA-256 hash confirming the entry was chained.
query_actionsLook up previously recorded actions from the audit trail. Use this to check what actions have been taken or recall past decisions.
Parameter | Type | Required | Description |
| string | No | Filter by agent |
| string | No | Filter by action type |
| number | No | Max entries to return (default 20) |
verify_chainVerify the integrity of the hash chain. Each entry's SHA-256 hash includes the previous entry's hash — if any record was modified, the chain breaks and this reports where.
Parameter | Type | Required | Description |
| string | No | Verify chain for a specific agent. If omitted, verifies all entries. |
Returns the number of entries verified and whether the chain is intact.
Each recorded action is hashed with SHA-256. That hash includes the previous entry's hash, forming a chain. Modify any record and every hash after it changes — verify_chain catches it instantly.
Sign up at agentseal.io. Free to use.
For direct integration without MCP: pip install agentseal-sdk. See agentseal-sdk.
MIT
Look up previously recorded actions from the audit trail. Use this to check what actions have been taken, verify history, or recall past decisions.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | No | Filter by agent ID | |
| action_type | No | Filter by action type | |
| limit | No | Max entries to return (default 20) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries the burden. It implies read-only behavior by saying 'look up', but does not explicitly state non-destructiveness, side effects, or permissions needed. It is adequate but could be more explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two succinct sentences, front-loaded with the main purpose, no redundant information. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity (3 optional parameters, no output schema), the description covers the main use. However, it omits details about the return format, which could aid agent understanding. Still, it is mostly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description does not add any extra meaning beyond what the schema already provides for each parameter. It is sufficient but not enhanced.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'look up' and the resource 'previously recorded actions from the audit trail'. It also lists use cases: 'check what actions have been taken, verify history, or recall past decisions'. This distinguishes it from siblings like record_action (write) and verify_chain.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use the tool (check actions, verify history, recall decisions). However, it does not explicitly mention when not to use it or compare to alternatives, though siblings are distinct enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Record an agent action to the AgentSeal audit hash trail. Call this after every significant action (sending emails, modifying files, running queries, making API calls) to create a cryptographically sealed record of what happened and why.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | Identifier for this agent (e.g. 'research-bot', 'finance-agent') | |
| action_type | Yes | What type of action was taken (e.g. 'email:send', 'file:write', 'api:call', 'db:query') | |
| action_params | No | Parameters of the action (e.g. {to: 'user@example.com', subject: '...'}) | |
| reasoning | No | Why you decided to take this action — your chain of thought | |
| authorized_by | No | Who or what authorized this action (e.g. 'user:alice', 'policy:auto-approve') |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, description carries full burden. Mentions 'cryptographically sealed record' hinting at immutability, but does not disclose side effects, permanence, or system impact. Adequate for a simple append action, but could be more detailed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences efficiently convey purpose and usage. No extraneous information; every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 params, nested objects, no output schema), the description covers purpose and usage well but omits mention of return value or additional behavioral context. Nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline 3. Description does not add extra parameter meaning beyond the schema; all parameters are already well-described in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool records actions to an audit trail, with specific verb 'Record' and resource 'agent action'. It distinguishes from siblings (query_actions, verify_chain) by focusing on recording, not querying or verifying.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises calling 'after every significant action' with examples, providing strong when-to-use guidance. Lacks explicit when-not-to-use instructions but context with sibling tools implies alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Verify the integrity of the audit trail hash chain. Each entry's SHA-256 hash includes the previous entry's hash — if any record was modified, the chain breaks and this will report where.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | No | Verify chain for a specific agent only. If omitted, verifies all entries. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the core behavior: verifies chain integrity, uses SHA-256, reports break location. However, it does not explicitly state whether the tool is read-only or has side effects, which is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences that efficiently convey purpose, mechanism, and behavior. No redundant or unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one optional parameter and no output schema, the description covers the key aspects: what it verifies, how it works, and what indicates tampering. It could optionally detail the output format (e.g., break location), but this is not essential for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not mention the agent_id parameter directly. However, the input schema already describes it clearly (100% coverage). The description adds no additional meaning beyond the schema, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Verify the integrity of the audit trail hash chain.' It explains the cryptographic mechanism (SHA-256 hash chain) and distinguishes itself from sibling tools (query_actions, record_action) by focusing exclusively on integrity verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly tells when to use this tool: when you need to detect data tampering via hash chain breaks. It does not explicitly state alternatives or when not to use, but the purpose is clear enough that an agent can infer appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0query_actionsrecord_actionverify_chainScored across 3 tools
Each tool has a clearly distinct purpose: record_action records, query_actions retrieves, verify_chain checks integrity. No overlap or ambiguity.
All tool names follow a consistent verb_noun pattern (query_actions, record_action, verify_chain), making them predictable and easy to understand.
Three tools is an ideal scope for an audit trail server, covering the essential operations of recording, querying, and verifying without unnecessary bloat.
The tool surface fully covers the core lifecycle of an audit trail: recording actions, looking up history, and verifying chain integrity. No obvious gaps given the domain's immutability requirements.
Bitcoin-anchored, tamper-evident audit log for AI agents — record, disclose and verify actions.
Issue & verify signed (ed25519), hash-chained, timestamped provenance receipts for agent actions.
Immutable event logging and audit trail for agent transactions
Tamper-evident proof creation and verification for AI agents via MCP, A2A, and REST.
