Attest proxy MCP server

Attest — prove what your AI agent actually did

Decide → Gate → Verify → Attest. Your agent sends the email, updates the CRM, moves the money. Attest decides whether it may, gates it behind a human when it matters, reads back from the system of record to check it actually happened, and records tamper-evident evidence either way.

Attest never executes your action. Your tool does. That is why it works with any app and any framework on day one.

Your agent says it worked. Did it?

Two identical CRM writes, both reported success by the tool, both approved by a human:

$ attest ledger
#2  2026-09-19 10:16:46  someweirdcrm.create → leads   ask  approved  unverified   a09e7641db12
#1  2026-09-19 10:16:46  someweirdcrm.create → leads   ask  approved  verified     77a6d99a60f6

The second one read back clean. The first did not, and the ledger says which field disagreed:

{ "level": "unverified", "matched": false,
  "evidence": { "compared": 4, "exists": true, "failed": ["stage"],
    "fields": { "stage": { "want": "qualified", "got": "new", "ok": false } } } }

A trace would have shown two green steps. That gap is the entire product.

Install

pip install attestlayer          # Python
npm  install attestlayer         # TypeScript — byte-identical ledger format

import attest

@attest.action(system="gmail", verb="send", target="to")
def send_email(to, subject, body): ...

import { Attest } from "attestlayer";

const at = new Attest({ agent: "followup-agent@v3", readers: { gmail: process.env.GMAIL_TOKEN! } });
const sendEmail = at.wrap({ system: "gmail", verb: "send", target: "to" },
                          async ({ to, subject, body }) => gmail.send({ to, subject, body }));

That is the whole change. The first external send now pauses for a human, and the ledger row says acknowledged, or verified once Attest can read back with the agent's own credentials (Attest(readers={"gmail": service})). Nothing else in your code moves.

Verification is layered, and it never overstates

Every row states exactly how much was checked. A check that could not run is never dressed up as a pass.

Only a contradiction earns unverified. Missing credentials, a read-only scope or an unsupported verb degrade to acknowledged, because "we could not check" and "it did not happen" are different facts.

Where it plugs in

Shortened. The full README is on GitHub.