Accountable Autonomy

Stop an AI agent before it acts, and hold proof of every decision that anyone can check.

Vaara sits in front of your agents and decides, on every single tool call, whether it runs: allow, block, or escalate to a human. Each of those decisions leaves a signed record. When someone who does not trust you asks what your agent did and why, you hand them the record instead of your word. Your own logs will not settle it, because you could have edited them.

From 9 December 2026 the EU Product Liability Directive treats software and AI as products under strict liability, and Article 10 lets a court presume your product defective if you cannot disclose the evidence. The burden of proof moves to you. This is the artifact that answers it.

Open source. No SaaS. No telemetry. No signup.

$ vaara verify-record someone-elses-record.json

conformance: CONFORMS
  [pass] required  alg_supported
  [pass] required  signature_hex
  [pass] required  result_commitment_self_consistent
                   projectionDigest == sha256 over the projection bytes
  ... 13 more checks, all pass

no signing key, no access to the system that produced it

Explore the Vaara Resin

What's shipped

• Check any record yourself: vaara verify-record tests any JSON against the published vaara.receipt/v1 format, including a record Vaara never produced, with no signing key and no access to the system that made it. vaara verify-bundle runs the full evidence set and prints a single pass or fail, fail-closed on authenticity.
• One sink for any stack's evidence: vaara ingest seals a record from another format, an MCP execution record or a did:web catalog entry, into one canonical, content-addressed envelope with an honest gap report, so a dropped record is a provable hole. The conformance corpus is reproduced by a checker that imports no Vaara.
• Hash-chained, tamper-evident audit trail (SHA-256, optional Ed25519, optional post-quantum ML-DSA-65), anchored to an RFC 3161 / eIDAS qualified timestamp so a record cannot be backdated against a clock you do not control. An auditor verifies it offline with a public key.
• Hardware-rooted binding: vaara verify-tpm-binding and vaara verify-tpm-chain tie an execution record to the machine's own TPM 2.0 quote and IMA measurements.
• Sovereign inference: run a local model through Vaara and every answer carries a signed receipt bound to the machine's TPM. Open under AGPL-3.0.
• One-command regulator package: vaara trail export-article12 writes the signed trail, per-article EU AI Act evidence, and the time anchor as Article 19 existence-in-time, in one file an authority checks offline.
• Policy gating on every tool call: allow, block, or escalate each agent action against your own policy before it runs, through a transparent MCP proxy with native hooks for LangChain, CrewAI, and the OpenAI Agents SDK. TypeScript client on npm, Claude Code plugin in the same repo.
• Author of the Vaara Receipt Internet-Draft (draft-sirkkavaara-vaara-receipt) at the IETF, an offline-verifiable execution-record format reproduced in full by an independent developer from a clean checkout. Releases are SLSA Build Level 3 and Sigstore-signed, with continuous fuzzing on the decoder, audit, and policy loader.

Paid pilots

• Four weeks, your environment, your traffic. Week 1: the Vaara MCP proxy goes in front of your agents in shadow mode, observing and recording without blocking anything. Weeks 2 and 3: we read the shadow report together, tune a policy and tool perimeter to your actual traffic, and flip to enforcement. Week 4: you receive a signed evidence bundle and an auditor-ready compliance report generated from your own trail.
• Everything runs in your infrastructure and stays there. The trail, the policy, the reports, and the archive are yours, and they stay verifiable with the standalone checker even if you never talk to us again. The evidence does not depend on the vendor; that is the point of the design.
• Building Vaara into a closed-source product, or running a modified version as a hosted service without releasing your changes, needs a commercial license instead of the AGPL, granted directly by the sole copyright holder. See LICENSING.md.

Talk to the author

• Running Vaara in production, or evaluating it for autonomous systems? I take on pilot deployments and can adapt Vaara to the stack you already have. Nothing here is gated: the code, the verifier, and the evidence format stay open whether we ever speak or not.
• Scope and price are agreed before any work starts, fixed, and exclude VAT. There is no subscription and no per-seat fee. A commercial license for building Vaara into a closed product is granted directly by the sole copyright holder, see LICENSING.md.

Talk to me about a pilot

Opens a message to hello@vaara.io. Four lines is plenty; I answer them myself.

Buy support now

• If you run Vaara in production and want the maintainer reachable without a contract cycle, the sponsor tiers are live and take a card immediately: github.com/sponsors/vaaraio. Monthly, cancel whenever, no procurement, no call. Companies expensing this against an OSS budget is the normal use.
• Sponsoring is not a licence. Building Vaara into a closed product still needs a commercial exception, and the paid work above is still the paid work.

Adoption (live)

• - live downloads, all time (PyPI and npm)

Acknowledged by

• Listed in the industry acknowledgements of the IMDA Model AI Governance Framework for Agentic AI v1.5 (Singapore, 20 May 2026)
• AMD AI Developer Program testimonial of Vaara (May 2026)
• OpenSSF Best Practices Project 12612 (passing)

Where