Agent Runtime Proof

Agent Runtime Proof

Prove the agent runtime you launched is the artifact you approved.

Agent Runtime Proof (ARP) is a local, read-only runtime identity verifier for AI agents and MCP servers. It detects stale, replaced, mismatched, or unverifiable runtimes without uploading code, secrets, process arguments, or process data.

The failure ARP is built for is simple: you replace an Agent or MCP executable, but yesterday's process keeps doing the work. The file on disk is new; the loaded runtime is not. ARP binds live process identity to an explicit artifact expectation and reports the uncertainty instead of treating the file on disk as proof of what is running.

See the reproducible stale-runtime demonstration, or start with the five-minute quickstart.

Quickstart

The current release is v1.1.0 for macOS arm64, Linux amd64, and Windows amd64. Download the archive and SHA256SUMS from that release, verify the bytes, then install the single binary in a user-owned directory. Full commands for each platform are in docs/quickstart.md; lifecycle and rollback details are in docs/install.md.

After installation:

agent-runtime-proof --version
agent-runtime-proof doctor --format json
agent-runtime-proof inspect --all --limit 20

Verify a process against an explicit expectation:

agent-runtime-proof verify \
  --expectation /absolute/path/to/expectation.json \
  --pid 1234 \
  --format json

ARP returns MATCHED only when the evidence supports that conclusion. UNKNOWN, STALE, LEAKED, CONFLICT, and NOT_RUNNING are domain verdicts, not transport errors.

Local stdio MCP

ARP can run as a local MCP server:

{
  "mcpServers": {
    "agent-runtime-proof": {
      "command": "/absolute/path/to/agent-runtime-proof",
      "args": ["mcp"]
    }
  }
}

It exposes exactly three read-only tools:

• list_local_runtime_candidates
• inspect_local_runtimes
• verify_local_runtime

Host profiles are available for Codex, Claude Code, Cursor, OpenCode, DeepSeek Harness, VS Code/GitHub Copilot, and generic hosts. See the host configuration guide. ARP does not edit the host's configuration.

The v1.1.0 Release also includes agent-runtime-proof_1.1.0.mcpb for compatible MCP clients. Its Registry metadata binds the bundle URL to its SHA-256 digest; the same three native binaries remain available as ordinary platform archives.

The same release is published in the official MCP Registry as io.github.fantasyce/agent-runtime-proof.

What ARP proves

These controls answer different questions and work best together:

Evidence	Question it answers
SBOM	What dependencies were declared in this build?
Signature or build attestation	Who produced these artifact bytes, and through which build?
Checksum	Did the downloaded bytes change?
Agent Runtime Proof	Is the live local process bound to the artifact expectation I approved?

ARP does not replace signing, provenance, SBOMs, sandboxing, or host policy. It closes the gap between an approved file and the process that is actually doing the work.

Privacy and safety boundary

ARP is intentionally narrow:

• local processes and local files only;
• CLI, local stdio MCP, and an optional launch Witness;
• read-only observation of Agent and host state;
• no daemon, network listener, repair action, or configuration write;
• no dependency on Across Agents Assistant, Across Context, Across Orchestrator, or Across Autopilot.

MCP responses omit raw argv, environment values, command lines, file contents, credentials, and transcripts. Read the exact guarantees and limitations in docs/data-handling.md, docs/privacy-model.md, and docs/threat-model.md.

CLI and Witness

Inspect one process or a bounded current-user inventory:

agent-runtime-proof inspect --pid 1234 --format json
agent-runtime-proof inspect --all --limit 100

Run a local command through the byte-transparent launch Witness:

agent-runtime-proof witness --expectation expectation.json -- command arg

The Witness records process identity and a content-addressed launch receipt, then proxies stdin/stdout without rewriting protocol bytes. Hosts that own process creation can embed the same contract through sdk/witness.

Exit codes are 0 for inspection, doctor, or MATCHED; 2 for a determinate negative verdict; 3 for UNKNOWN; 64 for invalid input; and 70 for an internal failure. JSON mode writes one JSON value to stdout; sanitized diagnostics use stderr.

Supported platforms and limits

Release archives are built for macOS 14+ arm64, Linux amd64, and Windows 11 amd64. Passive inspection of interpreter and declared-tree runtimes remains conservative when the active entrypoint cannot be observed. An on-disk digest alone is never reported as a loaded-runtime match.

Remote attestation, a daemon, network listeners, repair actions, and Agent configuration writes remain outside v1.

Architecture and acceptance

The same contracts and application layer drive the CLI, MCP server, Witness, and data-only Host Profiles. Technical design is documented in architecture-development-acceptance.md.

Acceptance records:

• Phase 0 contracts
• Phase 1 macOS core
• Phase 1 Windows core
• Phase 2 MCP
• Phase 3 Witness
• Phase 4 host matrix
• Phase 5 open-source release

Maintainers can run the complete source gate with:

bash scripts/check.sh

Release assets include CycloneDX SBOMs, SHA-256 checksums, and GitHub artifact attestations. Publication state is determined by the public GitHub Release, not by a local acceptance record.

Agent Reliability Toolkit

ARP is one independent part of a small, local-first reliability toolkit:

• Agent Recall Trail keeps private Agent memory separate from reviewed shared knowledge.
• Agent Runtime Proof verifies that a live Agent or MCP runtime matches the artifact you approved.
• Agent Residue Evidence records task-scoped files, processes, and listening ports left by tests and builds.

Each project remains separately installable and keeps its own trust boundary.

Community

Contributions and independent host/runtime cases are welcome. For a sanitized Codex or DSH integration, share the host, version, launch relationship, and observed proof boundary in the design-partner issue. DSH users can also join the official community discussion. Read CONTRIBUTING.md, CODE_OF_CONDUCT.md, and SUPPORT.md. Report vulnerabilities privately as described in SECURITY.md; do not put secrets or sensitive process data in a public issue.

Apache-2.0 licensed. See LICENSE.