Agent Runtime Proof MCP server

Agent Runtime Proof

Prove the agent runtime you launched is the artifact you approved.

Agent Runtime Proof (ARP) is a local, read-only runtime identity verifier for AI agents and MCP servers. It detects stale, replaced, mismatched, or unverifiable runtimes without uploading code, secrets, process arguments, or process data.

The failure ARP is built for is simple: you replace an Agent or MCP executable, but yesterday's process keeps doing the work. The file on disk is new; the loaded runtime is not. ARP binds live process identity to an explicit artifact expectation and reports the uncertainty instead of treating the file on disk as proof of what is running.

See the reproducible stale-runtime demonstration, or start with the five-minute quickstart.

Quickstart

The current release is v1.1.0 for macOS arm64, Linux amd64, and Windows amd64. Download the archive and SHA256SUMS from that release, verify the bytes, then install the single binary in a user-owned directory. Full commands for each platform are in docs/quickstart.md; lifecycle and rollback details are in docs/install.md.

After installation:

agent-runtime-proof --version
agent-runtime-proof doctor --format json
agent-runtime-proof inspect --all --limit 20

Verify a process against an explicit expectation:

agent-runtime-proof verify \
  --expectation /absolute/path/to/expectation.json \
  --pid 1234 \
  --format json

ARP returns MATCHED only when the evidence supports that conclusion. UNKNOWN, STALE, LEAKED, CONFLICT, and NOT_RUNNING are domain verdicts, not transport errors.

Local stdio MCP

ARP can run as a local MCP server:

{
  "mcpServers": {
    "agent-runtime-proof": {
      "command": "/absolute/path/to/agent-runtime-proof",
      "args": ["mcp"]
    }
  }
}

It exposes exactly three read-only tools:

• listlocalruntime_candidates
• inspectlocalruntimes
• verifylocalruntime

Host profiles are available for Codex, Claude Code, Cursor, OpenCode, DeepSeek Harness, VS Code/GitHub Copilot, and generic hosts. See the host configuration guide. ARP does not edit the host's configuration.

The v1.1.0 Release also includes agent-runtime-proof_1.1.0.mcpb for compatible MCP clients. Its Registry metadata binds the bundle URL to its SHA-256 digest; the same three native binaries remain available as ordinary platform archives.

The same release is published in the official MCP Registry as io.github.fantasyce/agent-runtime-proof.

What ARP proves

These controls answer different questions and work best together:

ARP does not replace signing, provenance, SBOMs, sandboxing, or host policy. It closes the gap between an approved file and the process that is actually doing the work.

Privacy and safety boundary

ARP is intentionally narrow:

Orchestrator, or Across Autopilot.

• local processes and local files only;
• CLI, local stdio MCP, and an optional launch Witness;
• read-only observation of Agent and host state;
• no daemon, network listener, repair action, or configuration write;
• no dependency on Across Agents Assistant, Across Context, Across

Shortened. The full README is on GitHub.