AgentLog-MCP: Tamper-Proof Signatures for AI Agent Operation Logs

When AI Agents Start Approving Deployments and Processing Refunds

AI agents are taking on more high-stakes operations — approving software releases, initiating refunds, modifying business records. Everything they do gets written to a log. But here's the problem: that log typically lives on the operator's own servers, and the operator is precisely the party with the most incentive to tamper with the record.

AgentLog-MCP is an open-source project aimed at closing that trust gap. The core idea is straightforward: sign every step an agent executes, and let anyone verify whether a record is authentic through a single natural-language question. In the demo, the author connects this capability to Alexa+ — a real MCP client communicating over the streamable HTTP protocol.

MCP (Model Context Protocol) is an open protocol released by Anthropic in late 2024, designed to standardize communication between large language models and external tools and data sources. Think of it as the "USB interface" of the AI agent world — whether it's a filesystem, database, API service, or local tool, any compatible AI client can call it directly as long as it implements an MCP server. The protocol uses JSON-RPC message format and supports communication via stdio or streamable HTTP. Alexa+ is one of Amazon's MCP clients built on this protocol, allowing users to invoke backend MCP tools through natural language commands. AgentLog-MCP packages its log verification capability as a standard MCP tool service, enabling any MCP client to seamlessly access audit functionality without requiring platform-specific integration.

Demo: One Question Tells You If Logs Were Touched

The demo scenario goes like this: yesterday, an agent responsible for release checking (release-checker) ran three times. The user simply asks Alexa: "What did my agent do yesterday? Were its logs tampered with?"

Alexa's response: release-checker ran three times yesterday, logging 18 steps total, with no tampering detected — though one run didn't end normally and may have been terminated early.

The critical detail here is that none of these conclusions come from reading some "status flag." Every result is computed in real time from hash values and signatures. This means even if someone modified a flag to cover their tracks, the verification logic won't be fooled.

What Happens When an Attacker Changes One Number

The real value shows up in adversarial testing. In the demo, an attacker with database write access directly modifies step 2 of the afternoon run: a failed health check (503) is changed to a success (200).

Ask Alexa again: "Were its logs tampered with?" The system immediately alerts: the 1:05 PM run (checking release version 1.4.3) has an untrusted step 2 — the content was edited after the agent signed it, and the signature no longer matches the content.

The author then demonstrates several escalation attempts by the attacker, each of which gets caught:

• Resign the forged step with an intruder's key: The system determines step 2 was signed by a non-agent key and is untrusted.
• Delete the step entirely: The system reports step 2 is missing, deleted, or expired — also untrusted.

In short, whether the attack involves modifying content, re-signing with a different key, or outright deletion, cryptographic verification catches the anomaly. The signature chain itself is tamper-resistant.

Resolving "He Said, She Said" Disputes

There's another highly practical scenario: a dispute between a customer and an operator. The customer's copy shows the staging environment was down, while the operator has modified their private evidence to claim everything was fine.

The user asks Alexa: "Regarding this afternoon's release, is the customer right or the operator?" The system's verdict: defer to the agent-signed version — the customer's copy matches the signature, the operator's does not.

This is where things get interesting. What was previously a dispute resolved through trust and verbal negotiation becomes a problem that can be objectively arbitrated with cryptographic evidence. The signature determines who tampered with the record.

Technical Implementation: Open Source, 56 Tests, One Command to Run

The underlying library is called agent-log, released under the MIT license, with 56 test cases included. The entire demo can be run with a single command. The author also demonstrates verifying a real run on a public archive testnet — nine steps, all agent-signed, chained together and archived, readable directly via RPC and verifiable on-site without any keys.

The demo's wire panel displays every MCP protocol message: the initialize handshake (protocol version November 25, 2025), MCP apps extensions, tools list, and tools call — fully exposing the communication between client and server rather than hiding the verification process in a black box.

Worth noting: the author openly acknowledges that this project was itself built with AI coding agents (Claude Code and others) and reviewed through code review — a small footnote in the story of AI tools building AI governance tools.

The public archive testnet refers to a blockchain test network used to store immutable records. AgentLog-MCP anchors the signature and hash chain of each agent run step to this kind of public ledger, allowing verification to completely bypass the operator's servers — anyone can independently confirm the integrity of a run by issuing an RPC read request to a blockchain node, without holding private keys or trusting any intermediary. This "on-chain anchoring, off-chain storage" architecture is a common pattern for verifiable log systems: raw log data (typically large in volume) remains in a traditional database, but its hash digest is written to an immutable public ledger, creating an independently verifiable "fingerprint archive." Even if the database is compromised or the operator destroys local data, the on-chain anchored hash still serves as an objective baseline for determining whether any copy of a log is authentic.

Why This Matters

As agents are granted real operational permissions, the auditability of "what it actually did" will become a hard requirement for enterprise deployments. The problem with traditional logs is that the recorder and the audited party are often the same entity — there's no independence. AgentLog-MCP decouples "the authenticity of a record" from "where the record is stored" through cryptographic signatures. Even if logs live on the operator's servers, even if the database is breached, signature verification can still tell you exactly which step was touched.

Wrapping the verification capability as an MCP tool and connecting it to a natural-language interface like Alexa+ lowers the barrier to auditing: no cryptography knowledge required — one question yields a traceable conclusion. For scenarios requiring compliance audits and accountability, this is a direction worth watching.

Of course, this is still a demo and an early-stage open-source library — production-grade reliability remains to be proven. But it clearly articulates a problem that is becoming increasingly urgent, and offers a technically grounded path forward.