What we build, and what each piece proves
WitnessOS is a family of components for governed agent action. The tools below are public and free and run on your machine. The governed-action engine is proprietary and runs inside your infrastructure under the design-partner programme.
Tools you can run today
Each card states the boundary plainly: what the component proves, and what it deliberately does not. Nothing here calls home.
PASSPORT
Identity and scoped authority
Issuer-signed claims for an agent, with the agent's own key bound inside the signature. Deny-by-default authorisation with machine-readable refusal codes, and holder-bound presentation over a single-use challenge.
Proves: which key speaks for an agent, and what that agent is allowed to do.
Does not prove: that the action happened. That is the evidence layer's job.
How it works · Repository · Python 3.10+
VERIFIER
Independent verification
Checks Ed25519 event and manifest signatures, canonical event chains, sequence bounds, event membership, binding to the signed batch root, Merkle inclusion proofs and authenticated RFC 3161 timestamps. Derives the evidence grade and exits non-zero when a bundle fails.
Proves: what an evidence bundle can actually support, with no gateway, no credentials and no network.
Does not prove: the identity of the keys beyond the trust anchors you supply yourself.
Repository · Python 3.12+ · OpenSSL 3 for timestamp authentication
MCP VALIDATOR
Declared versus observed
Captures what an MCP server publishes, observes what it does at runtime, and reports the gap: an annotation no longer bound, a contract that mutated, privilege used outside declared scope. Every result is committed to a SHA-256 hash chain whose head you keep elsewhere.
Proves: whether a server behaves like it says it does, and that the ledger of that comparison was not edited afterwards.
Does not prove: that the server is safe, or that its declarations are true of anything but its own behaviour.
Repository · Python 3.10+ · zero dependencies
EVIDENCE RECORD
A portable record format
A data model and validator for evidence records about agent actions, with samples and conformance vectors so two implementations can agree on bytes rather than on prose.
Proves: that a record is well formed and comparable across implementations.
Does not prove: anything about the record's content being true.
TXAUTHAGENT
Human authorisation, in hardware
An application profile on the W3C WebAuthn signing extension: the human's own authenticator signs a canonical digest of the exact action bytes. Verifiable against a published key, with no validation server and without breaking pairwise-credential privacy.
Proves: that a specific human authorised these exact bytes.
Does not prove: that the action was correctly executed afterwards.
Repository · MIT
EU AI ACT
Readiness grading
A self-assessment that maps an estate's logging and oversight posture to the record-keeping and human-oversight obligations that apply to high-risk systems.
Proves: where an estate stands against those obligations today.
Does not prove: compliance, and it is not legal advice.
Governed action, enforced before it happens
The WitnessOS gateway engine sits between an agent wanting to act and the agent being allowed to act. Policy is evaluated before execution, credentials are brokered rather than handed over, and each governed action produces a signed receipt whose evidence grade is derived from what the record can actually support.
It is proprietary, self-hosted and deployed inside your infrastructure, so no data leaves your estate and the signing keys are generated and held by you.
How it is delivered
Access is released through the design-partner programme, under NDA, with direct engineering support and a scoped deployment plan.
Live connector lanes: email dispatch for human-in-the-loop approvals, payment operations, and HTTP payment rails.
Built to be checked by someone who does not trust us
OpenSSF best practices
Every repository in the family carries an OpenSSF Best Practices badge, and three core projects hold all three baseline badges at a hundred percent. That is an independently audited supply-chain posture, not a marketing claim.
Signed releases
Release assets ship with Sigstore signatures, a checksum manifest and a CycloneDX software bill of materials, built by CI from a tagged commit. You can verify the artifact you install.
Honest by default
Where a capability depends on something we cannot supply, we say so. Retention by an independent custodian is supplied from outside, not proven by our code, and the grade does not move because you assert it.
Run the checks yourself
Install the tools from the instructions page, or watch the governed-action flow run in your browser first.