{"slug": "show-hn-mnestiq-tamper-evident-logs-of-what-an-ai-agent-saw-and-did", "title": "Show HN: Mnestiq – tamper-evident logs of what an AI agent saw and did", "summary": "A developer released Mnestiq, an open-source \"flight recorder\" for AI agents that produces tamper-evident, signed records of what an agent saw, decided and did, aimed at incident response rather than dashboards. Mnestiq hash-chains records using RFC 8785 canonical JSON and SHA-256 and periodically seals them with Ed25519-signed Merkle checkpoints under RFC 9162 trees, so edits, deletions, insertions and reordering fail verification. The tool captures provenance tags for system, user, model, tool_output, retrieved_doc, web, agent_msg and memory context, records outbound HTTP and raw TCP connections with local and remote IP and port, and ships as a drop-in SDK wrapping the Anthropic and OpenAI clients plus a `mnestiq proxy` mode that records model calls without code changes.", "body_md": "**A flight recorder for AI agents.** Tamper-evident, signed evidence of what an agent\nsaw, decided and did, built for incident response rather than dashboards.\n\nWhen an agent emails the customer list to an attacker, observability traces tell you\n*that* it happened. Evidence tells you *which* run and step did it, that the\ninstruction came from a web page rather than the user, that an auto-approve policy\nwaved it through, and lets you prove none of that was edited after the fact.\n\n``` php\nfirewall: 10.0.4.17:53120 -> 198.51.100.9:25 (50 bytes) [no agent identity]\n\nmnestiq: agent=support-bot run=c7831ff7 step=6 sandbox=container:7f3a9c operator=acme-helpdesk\n untrusted input earlier in the run: step 4: web via fetch_page\n authorized by policy:email-auto-approve (policy): recipient not checked against customer domain\n```\n\n- **Attribution:** every event carries`run_id` ,`step_id` ,`parent_run_id` ,`agent_id` ,`operator_id` and`sandbox_id` (auto-detected for containers and k8s pods).\n- **Egress identity:** outbound HTTP gets`X-Mnestiq-Run-Id` /`X-Mnestiq-Egress-Id` headers, and every outbound request*and* raw TCP connection (SMTP, databases, sockets)\nis recorded with its local and remote IP and port: the join key to flow and firewall logs.\n- **Provenance:** every piece of model context is tagged at capture time:`system` ,`user` ,`model` ,`tool_output` ,`retrieved_doc` ,`web` ,`agent_msg` ,`memory` . That's what makes prompt-injection analysis possible afterwards.\n- **Tamper evidence:** records are hash-chained (RFC 8785 canonical JSON, SHA-256)\nand periodically sealed by Ed25519-signed Merkle checkpoints (RFC 9162 trees).\nEdits, deletions, insertions and reordering fail verification.\n- **Redaction that keeps the proof:** strip prompts, tool arguments and tool output\nbefore handing evidence to an auditor; the chain still verifies.\n- **Drop-in SDK capture:** wraps the Anthropic and OpenAI clients (sync and async,\nChat Completions and Responses APIs). Recording fails open: it never breaks the agent.\n- **No code changes needed:**`mnestiq proxy` records an agent's model calls from outside it,\nwhatever language or framework it is written in. Point its base URL at the proxy.\n\n```\npip install \"mnestiq[anthropic]\" # or mnestiq[openai]\nmnestiq keygen --out keys\npython\nimport anthropic\nfrom mnestiq import FileSink, Recorder\nfrom mnestiq.keys import load_private_key\nfrom mnestiq.egress import instrument_egress\nfrom mnestiq.integrations.anthropic import instrument_anthropic\n\nrecorder = Recorder(FileSink(\"evidence.jsonl\"), agent_id=\"support-bot\",\n operator_id=\"acme-helpdesk\", signing_key=load_private_key(\"keys/signing.key\"))\n\n@recorder.tool(source=\"web\") # output of this tool is untrusted web content\ndef fetch_page(url: str) -> str: ...\n\nclient = instrument_anthropic(anthropic.Anthropic(), recorder)\ninstrument_egress() # stamp + record outbound connections during runs\n\nwith recorder.run(effective_permissions={\"email\": \"send\"}):\n client.messages.create(model=\"claude-sonnet-5-5\", max_tokens=1024, messages=[...])\n\nrecorder.close() # writes the final signed checkpoint\nmnestiq verify evidence.jsonl --trusted-key keys/signing.pub\nmnestiq inspect evidence.jsonl\nmnestiq redact evidence.jsonl evidence.redacted.jsonl\n```\n\nA key file the agent can read is fine for trying it out. In production, keep the key where\nthe agent can't read it: `signer=SignerClient.from_env()` with `mnestiq signer serve` running\nunder another account, or `signer=AzureKeyVaultSigner(...)`. See [docs/signing.md](https://github.com/mnestiq/mnestiq/blob/main/docs/signing.md).\n\n```\nmnestiq proxy evidence.jsonl --agent support-bot --key keys/signing.key\nexport OPENAI_BASE_URL=http://127.0.0.1:8787/openai/v1 # and/or\nexport ANTHROPIC_BASE_URL=http://127.0.0.1:8787/anthropic\n```\n\nThe agent runs unchanged. Every model call it makes is written to `evidence.jsonl`, signed.\nWhat the proxy can and cannot see, and how to deploy it so an agent can't go around it:\n[docs/proxy.md](https://github.com/mnestiq/mnestiq/blob/main/docs/proxy.md).\n\nA scripted support agent reads a poisoned web page and emails customer data out. You then investigate the evidence it left behind.\n\n```\ngit clone https://github.com/mnestiq/mnestiq && cd mnestiq\npython -m venv .venv && . .venv/bin/activate # Windows: .venv\\Scripts\\activate\npip install -e python httpx\npython examples/injection_incident.py --out evidence\nmnestiq dashboard evidence --trusted-key evidence/incident.pub\nmnestiq dashboard evidence/ --trusted-key keys/signing.pub\n```\n\nA local investigation view at the link it prints (`http://127.0.0.1:8765/?key=...`, whose key keeps\nother accounts on the machine out): runs and sub-runs, a step-by-step\ntimeline with every piece of model context colored by provenance, findings (below), the\nverification status of every record (sealed, unsealed, or tampered), and a connection\nfinder: paste an `ip:port` from a firewall or flow log and jump to the agent step that\nopened it. It live-updates while agents write.\n\n| Rule | Name | Fires when | \n|---|---|---|\n| `MNQ-001` | untrusted argument | A tool call's arguments carry an email address, URL, account number or long number that appears in untrusted content and nowhere in the system prompt or the user's messages. | \n| `MNQ-002` | auto-approval | An action was approved without a human after untrusted content reached the model, and the approved call carries a value from that content. A policy approving a routine reply is not a lead. | \n| `MNQ-003` | egress after taint | An outbound connection (not to loopback) followed untrusted content reaching the model. | \n| `MNQ-004` | untrusted sensitive action | A sensitive action (credentials, permissions, deletion, cancellations, account changes, payments, bookings) ran with an argument value that appears in untrusted content and not in the user's or system's words. Mark tools with `@recorder.tool(sensitive=True)` . Unmarked tools are judged by name. | \n| `MNQ-005` | untrusted link in answer | The model's answer carries an image, or a link with data in its query, to a host that appears in untrusted content and not in the user's or system's words. An image is fetched as soon as the answer is shown, so it can carry data out with no tool call. | \n| `MNQ-006` | internal data to new recipient | A tool sent data from the company's own systems (tool output labelled `internal` ) to an address or host that appears neither in those systems nor in the system prompt, such as the price list to a \"new customer\". No injection is needed. | \n\n`MNQ-001` is the signature of a hijack: an injected instruction has to put the attacker's\naddress, account or URL into a tool call. `MNQ-004` covers hijacks with no destination, such as\n\"change the password to ...\", \"delete file 13\" or \"cancel order 4100\". `MNQ-005` covers leaks\nthrough the answer itself, such as an injected image link that carries the customer's email\naddress. `MNQ-006` covers data handed to someone who simply asked for it. Findings describe what was observed, not a\nverdict: an agent that visits a link a colleague posted triggers `MNQ-001` too. The same\nrules are available in Python as `mnestiq.findings`.\n\nIt stays on your machine: it binds to loopback only, rejects non-local `Host` headers,\nrenders evidence strictly as text, and its Content-Security-Policy forbids the page from\nloading or contacting anything but the local server.\n\nTo see it with live data (no API keys needed):\n\n```\npython examples/live_agent.py --out evidence # keeps a scripted agent running\nmnestiq dashboard evidence --trusted-key evidence/live.pub\n```\n\nSee [`examples/injection_incident.py`](https://github.com/mnestiq/mnestiq/blob/main/examples/injection_incident.py) for a full\nincident: an injected web page leads to exfiltration over a raw TCP connection; a\nfirewall log entry is traced back to the exact agent step; a tampered approval is\ncaught; a redacted copy is shared.\n\nThe recorder runs inside your agent, so it is built to never be the thing that breaks it.\n\n| Concern | Behaviour | \n|---|---|\n| **Recording fails** (disk full, closed sink, odd values) | The agent carries on. Failures are counted in `recorder.failures` , logged on the`mnestiq` logger, and warned about once. Pass`strict=True` to raise instead, if an unrecorded action is worse than a failed one. | \n| **Process dies mid-write** | On restart, `FileSink` moves the torn last line to`.torn-