You're pledging to donate if the project hits its minimum goal and gets approved. If not, your funds will be returned.
$42,000 left to reach the funding goal.
AI agents now run shell commands, edit databases, send email and spend money. When one does something it shouldn't, the only record is usually a log written by the agent's own process, which the agent (or whoever runs it) can edit.
I built Tracekit to fix that. It's open source (MIT, pip install tracekit-ai, now v1.2.3). It checks every tool call before it runs (allow, deny, or hold for a human), signs each call into an append-only hash chain built like Certificate Transparency, and gives you one file per run that anyone can verify offline. The signing key never sits with the agent. It works with Claude Code, the OpenAI Agents SDK, LangGraph, the Claude Agent SDK and MCP.
Repo: github.com/Cygnux-Labs/Tracekit
Paper: arXiv:2609.35659
The weak spot today is that every test is mine. With this funding I want to:
Pay for an outside red-team of the signer, witness protocol and file format, and publish what they find.
Run a public witness, so anyone can get their agent logs cosigned by a party they don't control.
Turn tracekit why (replay a run without each suspect input to see which one caused an action) into a real benchmark: 300+ prompt-injection cases across several model families, results published with the misses.
The red-team report is public and the issues it finds are fixed. The witness is running and other people use it. The replay benchmark is out, with numbers for precision, recall and false blame. A few outside teams run Tracekit on real agents and tell me what broke.
At $42k (6 months): $30k for me to work on this full time, $6k compute and API costs for replay runs, $5k external security review, $1k hosting.
At the $8k minimum: the external review plus compute for a smaller benchmark.
Just me for now: Bravish Ghosh, founder of Cygnux Labs, Bengaluru.
Tracekit's own numbers (synthetic, written by me): 462 of 462 harmful tool calls stopped with 1 false alarm in 668 benign ones; 8 of 8 tamper attacks caught with a witness; 8 of 8 insider attacks against a system-mode signer caught; under 1 ms per call.
Before this I built Proof-Gated Signing, a Z3-based guard between an LLM agent and its signing key (93.6% of attacks blocked over 260 scenarios). Earlier: research assistant at Cambridge Judge Business School, Azure intern at Microsoft.
Most likely: the red-team finds design problems that take longer to fix than planned, or replay attribution turns out noisy on long runs. Either way the results get published, which is still useful to people building agent monitoring. The other risk is adoption: if teams don't take up an open evidence format, the impact stays small.
$0 so far. I've applied to GTR, EA Funds, the goose grant and a few others; nothing has come through yet.
There are no bids on this project.