How do you prove what an AI agent actually did?
You give each piece of work a signed receipt: a record of what went in, what came out, which model ran, how long it took and what it cost, sealed with a cryptographic signature so that changing a single character breaks it. Anyone can check that seal offline, without an account and without trusting the person who sent it.
That's what Agent Receipts does. The idea came from building ModQuote: AI-drafted quotes are on its roadmap, and when a customer disputes a $2,400 quote, "the agent said it applied the right pricing" isn't good enough. It's free and open source, and the website itself is a working demo: edit any word on receipts.webaes.com and its stamp turns to VOID.
Why aren't logs enough?
Two reasons. Logs are written by the agent about its own work, and they can be edited after the fact. "I updated three files and all tests pass" is a sentence the agent wrote; nothing in the log proves it.
Logs also live inside your system. A client, a manager or an auditor can only read them by trusting you and your server. A receipt is different: it travels on its own, and the person holding it can verify it themselves.
What's actually in a signed receipt?
An Agent Receipts receipt is plain JSON. It records SHA-256 fingerprints of the inputs and outputs (so the raw data never has to leave your machine), a manifest of every file that went in and came out with its own fingerprint, the model that ran, tokens, time taken and cost, timestamps, and a link to the previous receipt.
All of it is signed with Ed25519. Since receipt format v2, every field is covered by the signature, not just a handful, and each receipt names the key that signed it. Because every receipt links to the one before it, deleting or editing a receipt in the middle of a history is detectable too.
Who can check a receipt, and how?
Anyone. A receipt can be dropped onto a verify page and checked right in the browser, with nothing uploaded. It can be checked from the command line with npx @agent-receipts/cli verify, or in code. Webaes's own receipts check at verify.webaes.com.
One subtlety matters. A receipt file carries its own public key, so on its own it proves the receipt hasn't changed since it was signed. To prove who signed it, you check it against the issuer's published key. That's why a business hosts its own verify page with its key built in: receipts from that business show green, anything signed by another key shows red.
How do I add receipts to my AI agent?
In Claude Code, the simplest way is automatic: npx @agent-receipts/cli hooks install. From the next session on, every file edit, file write and shell command gets its own signed receipt, chained per session, with a summary when the session ends; there's also a Claude Code plugin that does the same. For any other MCP server, put agent-receipts proxy in front of it and every tool call through it is signed.
To have your agent record its own work, for Claude Code, Claude Desktop, Cursor or any MCP client, add the MCP server: claude mcp add agent-receipts -- npx @agent-receipts/mcp-server. Then run npx @agent-receipts/cli prompts claude-code and add its output to your project instructions, so your agent knows to call track_action after anything that matters. The server has 24 tools, including verification, receipt chains and persistent memory.
If you'd rather do it from code, the TypeScript SDK is two lines: create new AgentReceipts(), call ar.track() with the action, input and output, and ar.verify() checks it. Keys and receipts live in a local SQLite file in ~/.agent-receipts. There's no account and no cloud, and npx @agent-receipts/dashboard shows everything in a local web dashboard.
What doesn't a receipt prove?
It's worth being precise. A receipt proves what was recorded and that nothing has changed since it was signed. It doesn't prove the work is good; that's still your review.
Through the MCP server, a receipt exists only when the agent calls track_action, so an agent could skip it. Where you need a guarantee, let the harness write the receipt instead of the agent. The Claude Code hook does that: it runs outside the agent and signs a receipt for each action the moment the tool finishes, so nothing depends on the agent remembering, and the agent can't rewrite a receipt afterwards without breaking it. It proves what Claude Code reported, not that the work was right, and in a scripted claude -p run the very last action can go unrecorded. Magic Folder works the same way: the program that runs the job hashes the real files and signs the receipt, and the agent never touches it.
And a receipt is only as trustworthy as whoever holds the signing key. The keys live on your own computer, so you control them, which is why the published key matters: it tells everyone else which key to trust.
What does it cost?
Nothing. Agent Receipts is open source under the MIT license and runs on Mac, Windows and Linux with Node.js 22.16 or later. The code is on GitHub, and the install guide and live demo are at receipts.webaes.com.