Prove what your AI agent was authorized to do
— and what it actually did
Capability tokens set hard limits — spend caps, merchant allowlists, delegation chains that can only narrow. Every action becomes a signed Action Receipt bound to the token that authorized it, Merkle-anchored on Base mainnet, and verifiable offline without trusting GARL.
GET STARTED IN SECONDS
Python & JS SDKs, REST API, MCP config, GitHub Action — send your agent's activity, get signed receipts
Add your agentSelf-register, get an agent identifier, and start building your verifiable trust profile
Read onboarding guideSend this to your AI agent:
import garl
# Initialize once
garl.init("garl_your_key", "agent-uuid")
# One line after any action — returns a signed receipt
receipt = garl.log_action("Generated REST API", "success", category="coding")
# → SHA-256 hashed, ECDSA-signed, anchored on Base ✓
# Share it — anyone can verify the receipt offline
print(receipt["receipt_url"])What you get
Connect an agent once. Hold proof of what it was allowed to do — and what it did.
Prove what was allowed
Capability tokens carry scope, spend limit, merchant allowlist, and expiry. Delegated tokens can only narrow — every link in the chain is re-checked at verification.
Prove what was done
Every action is an ECDSA-signed Action Receipt that references the token that authorized it. Immutable ledger — no edits, no deletes.
Verify it independently
Receipts are Merkle-anchored on Base mainnet. Reviewers, auditors, and counterparties verify signature and inclusion offline — no trust in GARL.
How It Works
Three steps from authorization to independent proof
1. Authorize
Issue a capability token: scope, spend limit, merchant allowlist, expiry. Delegation can only narrow it. The Capability Gate escalates low-trust irreversible actions to a human.
2. Record
Every action becomes a SHA-256-hashed, ECDSA-signed Action Receipt bound to its capability token — via SDK, MCP, REST, or the GitHub Action. Immutable ledger; no edits, no deletes.
3. Anchor & Prove
Receipts are Merkle-batched and anchored on Base mainnet, and can carry the commit's real CI result. Anyone re-verifies the signature, the on-chain inclusion proof, and the CI attestation — no trust in GARL required.
The Verification Stack
Authorization limits, signed evidence, on-chain anchoring — and the integrations to produce them anywhere
Capability Tokens
ES256K-signed authorization with spend_limit_usd, merchant_allowlist, side_effect_class, and expiry. Biscuit-style attenuation: a delegated token can only narrow its parent, enforced at issue and re-checked link-by-link at verify.
Capability Gate
Pre-flight check before risky actions: below-threshold irreversible requests return requires_human instead of a token. Decisions land in the receipt as policy_decision.
UETA §10(b) Undo
Reversible receipts carry a recorded compensation path. POST /receipts/{id}/undo triggers it — refused for irreversible actions, owner-key required.
Cryptographic Certificates
ECDSA-secp256k1 signatures with SHA-256 trace hashes. Every execution carries tamper-proof proof-of-completion.
On-Chain Anchoring
Action Receipt batch Merkle roots are anchored on Base mainnet (MerkleAnchor 0xBeD7EdeF…, chain 8453). Each anchored receipt has an inclusion proof verifiable against the on-chain root via verifyProof — trustless, no GARL required.
Immutable Ledger
PostgreSQL triggers prevent any modification or deletion of execution traces. Every record is permanent and auditable.
MCP + A2A compatible
MCP server with 29 named tools ships on npm; A2A v1.0 agent-card endpoint is live. Works with Claude Desktop, Cursor, Windsurf, and any MCP/A2A-aware runtime.
Webhook Notifications
Full CRUD webhook management — create, list, update, deactivate, delete. HMAC-SHA256 signed payloads.
Enterprise PII Masking
Optional SHA-256 hashing of input/output summaries. Prove execution happened without exposing sensitive data.
Integrate Everywhere
SDKs, MCP tools, REST endpoints, GitHub Action — plug GARL into any code or agent stack
Python SDK
Sync + async clients, one-liner API, auto-retry with exponential backoff
JavaScript SDK
ESM module with retry, background logging, multi-model attestation helper
REST API
62 endpoints — receipts, capability tokens, anchors, evidence packs, session alerts, inclusion proofs, badges, GDPR export
MCP Server
29 tools. Claude Desktop, Cursor, Windsurf — one config line
GitHub Action
5-line PR workflow. Detects Claude Code, Cursor, Copilot, Aider, Codex commits and posts signed receipts — now with the commit's real CI result attached.
Security by Design
Not just encrypted — architecturally immutable
ECDSA-secp256k1 Signatures
Same elliptic curve used by Bitcoin. Every trace is signed with a protocol-level private key. Certificates are publicly verifiable.
SHA-256 Trace Hashing
Each execution trace is independently hashed. The trace_hash field enables quick integrity checks without full signature verification.
Immutable PostgreSQL Ledger
Database triggers prevent UPDATE and DELETE on traces and reputation history. Once written, records are permanent.
API Key Hashing
API keys are SHA-256 hashed before storage. Plaintext keys are only shown once at registration — never stored or logged.
Sign it.
Anchor it. Prove it.
Every agent action gets two proofs: the capability token that allowed it, and the signed receipt that recorded it — anchored on Base, verifiable offline. GARL is the open authorization-and- evidence rail for AI agents.
OFFICIAL PROTOCOL VERIFICATION KEY
ECDSA-secp256k1 public key used to sign all GARL certificates. Use this key to independently verify any execution trace.
b7c8a722a026fd417eea90cc2fe83a99c2db5376a87f4c1611fc641a643f7cc3a9c68eb1e5743a10677cbfd548dcedef5064bc845aadf7df1046eef4ac9a3e8fAlgorithm: ECDSA-secp256k1 · Hash: SHA-256 · Protocol: GARL