The independent evidence layer for autonomous software.
Software agents now act on real systems. They open pull requests, move money, read patient records, provision infrastructure, and hire other agents to do work on their behalf. The industry has spent the last two years deciding how to give them identity and how to constrain what they may do.
It has spent almost no time on the harder question that follows.
When an agent takes an action, who can prove what actually happened?
Not a sampled trace kept for a week. Not a log the acting system can rewrite. A complete, tamper-evident record that a third party can verify without trusting either the operator or us.
The organisations that control agents cannot be the ones who certify what those agents did. An identity provider attesting to its own enforcement is marking its own homework, and no regulator or counterparty should accept it.
Independence is not a limitation we are working around. It is the product. It is also a position that no hyperscaler can occupy, no matter how much capital they bring to it.
Each stage is useful on its own, and each one earns the position for the next.
| Stage | Status | |
|---|---|---|
| Observe | Read what a server declares about its own authorization | Shipping |
| Record | Hash-chained, sealed, tamper-evident log of agent actions | In design |
| Identify | Bind records to agent identity, building on SPIFFE rather than reinventing it | Planned |
| Enforce | Policy at the same chokepoint the record already occupies | Planned |
| Verify | Third-party attestation that neither operator nor vendor can forge | Planned |
| Delegate | Capability inheritance when an agent creates another agent | Researching |
| Settle | Accounting and settlement between agents | Researching |
adjent checks whether an MCP server conforms to the 2026-07-28 authorization specification, which made RFC 9728 protected resource metadata and RFC 8707 resource indicators mandatory. Most servers deployed before that date satisfy neither.
go install github.com/adjent-dev/adjent@latest
adjent check https://your-server.example.com/mcpThat is the whole of it so far. Everything above marked planned is intent, not implementation, and this page will say so until it is untrue.
We report only what we can verify. Where a question cannot be answered by the method we are using, our tools say so rather than guessing. A verdict we cannot support is worse than no verdict.
Consent before inspection. Our tools read what systems publish about themselves. They do not probe infrastructure for weaknesses, and they will not acquire a mode that tests targets the operator has not authorised.
We should not be able to read your data. The recording layer is being designed so that records are sealed where they are produced, and we hold the proof of integrity rather than the contents. A neutral party that can read everything is not neutral for long.
Build on what exists. SPIFFE solved workload identity. Sigstore and in-toto solved signing and attestation formats. MCP and A2A solved interoperation. We intend to compose these rather than compete with them.
Everything here is Apache-2.0. Issues, corrections, and disagreement about the direction are all welcome. If you operate MCP servers at any scale, we would particularly like to hear what breaks.