Innsegl

Open source · Apache-2.0

A verifiable record of what your AI agents did.

Innsegl records every agent run from its own model traffic, gives the run a short-lived cryptographic identity, and signs the commits it makes. Anyone can check who made a commit — against public transparency logs, without trusting your server or whoever runs it.

Run a core Verify a commit

Innsegl is Norwegian, from Old Norse innsigli: the seal pressed on a document to prove who issued it.

How it works

  1. 1

    Your machine

    Claude Code reaches the model through a small client. Nothing changes for the person or the agent.

  2. 2

    The core records

    Your core's gateway records the task, every tool call and its result, and which agent started which.

  3. 3

    Commits are signed

    Each run gets its own identity. Its commits are signed with a short-lived certificate and logged in Rekor.

  4. 4

    Anyone verifies

    Three checks against git, Fulcio and Rekor. None of them asks your server anything.

What you get

Recorded from the traffic

Agents call nothing themselves. The harness's own telemetry is a second witness, and a disagreement between the two is raised as an alert.

One identity per run

SPIRE issues each session and subagent its own short-lived identity, and retires it when the run ends.

Commits signed, not asserted

The commit's Agent-* trailers are the claim; the signature is the proof. If any step fails, there is no signature.

A ledger nothing rewrites

Events are hash-chained, sealed into segments, and each segment is anchored in Rekor. Corrections are new events.

Outages don't stop work

If the core is down, the client sends the request on and keeps a signed journal that the core checks and records later.

A dashboard to read it

Runs, repositories, alerts and machines behind passkey sign-in. Connecting or revoking a machine takes a passkey.

Verify a commit — no Innsegl needed

go install innsegl.dev/innsegl/cmd/innsegl@latest
innsegl verify <commit> -repo .

The exit status is the verdict, so it fits in a script:

0verified
3failed — the commit does not hold
4could not be checked — never reported as failed
5the commit makes no attribution claim
6unusable — no such commit, or a configuration that cannot verify

The checks: the signing certificate chains to Fulcio; the commit's entry is included in Rekor; the identity in the trailer is the one in the certificate. The verifier has no flag to point it at a database.

Get started

  1. Run a core on a host of your own

    git clone https://github.com/Raymalian/innsegl.git
cd innsegl && ./install.sh

    It brings the stack up — SPIRE, Postgres, a self-hosted Sigstore and Innsegl — and prints the dashboard's address and a one-time setup link.

  2. Connect each machine that runs agents

    innsegl connect https://<core>:28095 \
  --token <ie_…> \
  --ca-fingerprint sha256:<hex>

    The dashboard's Account page creates the token and shows this command with the fingerprint filled in.

  3. Check it

    innsegl status

    Says what is up and what is down between the machine and its core, and exits non-zero naming whatever is down.

Recording works with Claude Code. Innsegl is pre-1.0 with no tagged release yet, so @latest builds the default branch; the module is a program, not a library.

What it does not do

For integrators

innsegl.dev/innsegl
The Go module path. This domain serves the go-import tag that sends the toolchain to the repository. See the tag.
spiffe://innsegl.dev
The reference trust domain. It is a name, not an endpoint: nothing listens on it and nothing connects to it.
Frozen surfaces
The event schema, the canonical serialization, the commit trailer keys, the SPIFFE ID grammar, and the MCP tool names and error classes change only in a major release, with a migration attestation — changing them would invalidate proofs already made.