Home

Tracekit

Tracekit records what an AI agent does as evidence that people who weren't there can check. A signer the agent can't control decides each tool call against your policy, then signs the call, the decision and the result into a hash-chained log that independent witnesses cosign. Each run exports as one .tkb bundle that anyone can verify offline, against keys they chose to trust.

Start here

• Quickstart: the v2 signer: a signed, verified run in a few minutes
• Coding agents other than Claude Code: Codex, Cursor and Gemini CLI; Claude Code is in the quickstart
• How Tracekit works: the design, one concept per page, in reading order
• Integrations: frameworks, sandboxes and gateways
• Reading a v2 verify report: what each line of tracekit verify means
• Deploying the signer: a signer the agent can't reach
• FAQ and limits: what a verified run proves, and what it doesn't