Lotor MCP server

Lotor

A local receipt and approval gate for AI agent sessions. The agent can act, but it cannot sign.

What it is

Lotor writes a signed, tamper-evident log of what an agent did during a session: actions performed, files touched, messages sent, costs incurred, failures encountered. The log lives on your machine, in a format you can inspect, verify and archive.

It does not prove the agent's actions were correct. It records them, and makes later tampering detectable.

It also gates the actions you choose. Those stop and wait for an approval signed with a passphrase the model has never seen and cannot derive. An agent can request a consequential action. It cannot authorize one.

Local first, and not as a deployment option. The receipt is written to your machine and nowhere else. No upload path, no account, no server component. Nothing leaves because nothing is built to send it. Much accountability tooling is cloud observability, which means your agent's history becomes inventory in someone else's books. Lotor is not the only local one: Obsigna (agentreceipts.ai) ships a local, signed, tamper-evident record with a Claude Code hook, is formally verified, and predates this repo. What this repo adds on top of a record is the gate that blocks until a human signs, and a ledger that confesses its own limits. The record of what your machines did for you should answer to your key, not to a vendor's retention policy.

Longer arguments for why that matters live at ikeanalytics.com, including the measurement behind them. This file is about running the thing.

What you use it for

Know what ran. Ask the record instead of re-reading transcripts. It is cheaper than reconstruction and it is not subject to the agent's account of itself. A worker in this project once reported which model it was running on, in the section of its own report reserved for admitting uncertainty, and was wrong. The receipt was not.

Sleep through it. Wake up to a signed account of an unattended run rather than a pile of transcripts you will never read.

Stop the expensive ones. Deletes, deploys, sends and spends fail closed until you sign that exact action with its exact parameters. The denial and the approval are both receipted.

Hold your own copy. When a client, vendor or counterparty disputes what happened, the record is yours. Their books, and now yours.

Claim discipline

Measurement, not indictment. A receipt records what the session self-reports. It does not judge intent and it does not catch silent failures.

Self-attested capture. The log begins at signing time. What happened before that moment is not covered by the chain.

Nothing written in the present tense here is unbuilt. Anything not built is named as pending, in the same breath, either below or in KNOWN-LIMITS.md.

Herding modes

Ten matchers is not a posture anyone can hold in their head. Three presets replace the matrix with one choice.

self-mod and mode-change gate in every mode, with no exception. Loose means free to act on the world, not free to rewrite what stops you. An agent in Loose still cannot edit the gate, its policy, its hooks, or switch modes without your signature.

Loose never turns a rule fully off. It warns, which still appends a receipt. The alternative would make the most dangerous mode the one that leaves the least evidence, since an unmatched rule takes a fast path with no chain write.

Shortened. The full README is on GitHub.