XAIP — Signed Execution Receipts for AI Agent Tool Calls

Evidence before delegation. Wrap an agent's tool calls once; use the receipt history locally today, and share the same signed receipts later as portable, independently verifiable evidence.

XAIP is a provider-neutral signed execution evidence layer for AI agent tool calls. It records co-signed receipts — both the executing agent and the caller sign the same canonical record, so neither side can unilaterally fabricate one — across MCP, LangChain.js, OpenAI-compatible tool-call loops, and other runtimes, then exposes historical execution evidence that agents, developers, or policy layers can inspect before delegation.

Receipts are the primary artifact. Trust scores are one derived view over those receipts — not a claim of absolute safety or correctness.

XAIP in 30 seconds

• Mechanism — one tool call in, one receipt out. The executing agent and the caller sign the same canonical record (Ed25519 over JCS), so neither side can unilaterally fabricate or repudiate it. Only hashes of input/output are carried; content never leaves your machine.
• What you get on day one — a verifiable history of what your own agent's tools actually did, queryable before the next delegation (precheck()). Useful single-player; no network of other users required.
• What XAIP is not — not a sandbox, not an approval engine, not a payment rail, not a safety guarantee. It makes execution evidence visible; you decide what to trust.

Pick your depth: 3 minutes — produce your first signed receipt · 10 minutes — verify the format yourself: run the executable conformance vectors (node check.mjs, no dependencies), then skim the Internet-Draft it pins.

Live demo: three candidate servers, side-by-side comparison without and with XAIP. Open in browser →

Provider-agnostic by design. XAIP is a trust layer for any tool-using agent. The reference implementation and live data start with MCP (Model Context Protocol) — because that's where the broadest fleet of public tool servers exists today — but the receipt format, signing, and scoring apply equally to LangChain tools, OpenAI function calling, A2A, and proprietary agent stacks. MCP is the first integration, not the only one.

Live dashboard: https://xkumakichi.github.io/xaip-protocol/ — current public trust scores, auto-refreshed, no auth. The current public dataset is MCP-heavy because MCP was the first integration target.

Entry points

• Trust Evidence Before Delegation — one-screen demo, live POST /v1/select against three contrasting candidates.
• Before Payment Evidence Demo — one-screen demo: what an agent sees about a paid closed-source skill before paying, with vs without execution evidence from precheck() (three fictional candidates, seeded fixture).
• Browser playground — read-only demo of trust-aware selection.
• 60-second overview — the problem XAIP is trying to address.
• Future direction — long-term hypothesis, open questions, and current research asks.
• Single-caller dominance case study — a real failure mode surfaced in XAIP's own public dataset on 2026-05-13, and what it implies for caller diversity.
• Agent Trust Check design — planned diagnostic concept.
• [Class-aware scoring design](./docs/class-aware-scoring-desig

... View full README on GitHub