Skip to content
Reeve

Accountability for AI agents

The flight recorderfor AI agents.

Reeve records every tool call your AI agents make — checked against policy, held for a person when it matters, and sealed so anyone can verify it later.

Get started
Connectingsupport-agent
09:41:18
seq
0/7

Sample session · MCP gateway, enforce mode

01The problem

AI agents can act.
Can you answer for them?

Agents call tools, read customer data and move money on their own. When someone asks what happened, these are the questions. Each one maps to a field Reeve records.
  1. Q01What happened?→ event_type · timestamp
  2. Q02What did the agent call?→ action · arguments
  3. Q03What waited for approval?→ awaiting_approval
  4. Q04Who approved it?→ decision · reviewer
  5. Q05What policy allowed it?→ policy_rule
  6. Q06Can we prove the record wasn’t changed?→ hash · checkpoint

02Observe → Trace → Control → Audit → Prove

One layer.
Five jobs.

The audit trail is where it starts. The gateway puts Reeve in the path, which is what turns a log into control.

02.1

Observe

See every agent action as it happens.

Gateway calls, Claude Code tool use and HTTP sources land in one stream — normalised into one shape and sealed on arrival.

sources
mcp_gateway · claude_code · http
view
live tail · filters in the URL
  1. 09:41:21mcp:stripe/create_refund · support-agentheld
  2. 09:41:20chat.completion · invoice-agentsuccess
  3. 09:41:19mcp:postgres/query · support-agentsuccess
  4. 09:41:19tool:Bash · repo-agentsuccess
  5. 09:41:18mcp:zendesk/get_ticket · support-agentsuccess

02.2

Trace

Follow a call from intent to outcome.

Every tool call is two records joined by a call_id: what the agent tried, and what came back. The gap shows where a human stepped in.

join
call_id · gateway_session
results
shape and size only
gw_7f3a91 · 4 calls · 7 records09:41:18 → 09:41:53
agent callwaiting on a persontool executes
call_id
c3
records
48215 → 48216
reviewer
ops-oncall · approved
execution
71 ms

02.3

Control

Decide what agents may do — before they do it.

Policy is evaluated in the transport path. Allow, deny, or hold for a person — and the reviewer, the rule and the time are recorded with the call. An org-wide halt outranks every rule.

decisions
allow · deny · require_approval
reviewers
Slack · webhook · email

Incoming call

args { "amount": 18000 }

Policy

block_secrets    on
deny_tools       filesystem__write_file
require_approval stripe__create_refund
holdrecorded · seq sealed
policy
require_approval — stripe__create_refund
reviewer
ops-oncall · approved via Slack
timestamp
09:41:21.105 → decided 09:41:52.630

02.4

Audit

A record that can’t be quietly changed.

Each record is sealed and chained to the one before it. Edit one, and every link after it breaks. Try it — the hashes are real.

seal
HMAC-SHA256 · hash chain
storage
append-only, enforced in the database
sha-256
  1. genesis0000000000000…
  2. 48211intent zendesk/get_ticket allow························✓
  3. 48212outcome zendesk/get_ticket success························✓
  4. 48213intent postgres/query allow························✓
  5. 48214outcome postgres/query success························✓
  6. 48215intent stripe/create_refund require_approval························✓
VERIFIED · chain intact

02.5

Prove

Hand an auditor something they can check.

Exports carry an Ed25519-signed checkpoint. One dependency-free script verifies them offline, against a key the auditor holds — not Reeve.

signature
Ed25519 checkpoints
verifier
reeve-verify.mjs · 150 lines
offline

03Anatomy of a call

One call,
end to end.

A refund, requested by an agent, held for a person, executed and sealed. Scroll to follow it into the record.

  1. 01 / agent_name

    Agent starts

    support-agent opens a session through the gateway — the only MCP server its host can see.

    agent_name
    support-agent
    source
    mcp_gateway
    gateway_session
    gw_7f3a91

  2. 02 / action

    Tool call created

    The model asks for stripe/create_refund. Anything credential-shaped in the arguments is scrubbed before it leaves the process.

    action
    mcp:stripe/create_refund
    arguments
    { "amount": 18000, "reason": "duplicate" }
    call_id
    c3

  3. 03 / phase

    Policy evaluated

    Halt first, then rules by priority. The first match is require_approval on stripe__create_refund.

    phase
    intent
    policy_rule
    refunds

  4. 04 / awaiting_approval

    Approval requested

    The call is held. The intent is written before anything runs, and a reviewer is asked in Slack. The agent waits.

    awaiting_approval
    true

  5. 05 / decision

    Reviewer responds

    ops-oncall approves after 31.5 seconds. Had nobody answered in time, the gateway would have refused — it fails closed.

    decision
    approved · ops-oncall · 09:41:52.630

  6. 06 / outcome

    Tool executes

    The call runs. The result is described by shape and size; its content is never stored.

    outcome
    success
    duration_ms
    71
    result
    { "result_kind": "text", "bytes": 412 }

  7. 07 / seq

    Event committed

    The record takes the next sequence number and an HMAC seal over its content and the seal before it. The table refuses edits and deletes.

    seq
    48216
    prev_hash
    9b14e07c3d6a…
    hash
    1fe937b0c4d2…

  8. 08 / checkpoint

    Record verifiable

    An Ed25519-signed checkpoint covers the range. Anyone can check it offline, with a key they hold.

    checkpoint
    ed25519 · key 1 · 48211…48217

04Platform

In the path,
not beside it.

Your host connects to the gateway; the gateway connects to your MCP servers. The model can’t route around it — it’s the only server the host can see. That is the difference between telemetry the model opted into and a record.

  1. Agent hosts

    Claude Code · Cursor · any MCP host

  2. Reeve gateway

    observe · trace · control · seal

  3. Your MCP servers

    filesystem · github · postgres · stripe

  4. Ledger

    append-only · Ed25519 checkpoints

    HTTP sources write here directly

monitordefault

Records in the background. A failed audit write never blocks a tool call. No added latency.

enforceregulated

Writes the intent and waits for the acknowledgement before the call runs. If the write fails, the call is refused.

05Developers

No SDK.
Three ways in.

Point an MCP host at the gateway, post from anywhere over HTTP, and verify what you get back with a script you can read in five minutes.

runtime
Node 18+
hosts
any MCP host
auth
Bearer key · per org
redaction
credentials scrubbed before send
Read the docs 
{
  "mcpServers": {
    "reeve": {
      "command": "node",
      "args": ["./agentledger-gateway.mjs"],
      "env": {
        "AGENTLEDGER_GATEWAY_CONFIG": "./gateway.config.json",
        "AGENTLEDGER_MODE": "enforce"
      }
    }
  }
}
$ git clone https://github.com/p6derpriit-blip/agentledger-gateway

06The product

Dense where
it matters.

Built to be read for hours, not glanced at once. The same session as above — open a record, resolve the approval, verify the chain.
reeve · demo workspace · /events

Events

9 records
24hall sourcesany status live
records
9

seq 48208 → 48216, contiguous

held
1

stripe/create_refund · ops-oncall, 31.5 s

blocked
0

nothing refused yet

time in tools
1.1 s

1 failure · repo-agent tool:Bash exit 1

timetoolstatus
09:41:52stripe/create_refundsuccess
09:41:21stripe/create_refundheld → ok
09:41:19postgres/querysuccess
09:41:19postgres/queryallowed
09:41:18zendesk/get_ticketsuccess
09:41:18zendesk/get_ticketallowed
09:41:04Bashfailure
09:40:58Editsuccess
09:40:51Readsuccess

Sample data · interactive

07Trust

Built to be
checked.

Mechanisms, not adjectives. Reeve holds no certifications yet, and the security page says so.
01Append-only records
Database triggers refuse UPDATE and DELETE on the ledger — for Reeve's own service role too. A record, once sealed, can only be added to.
02Cryptographic chaining
Each record's seal covers its content, its sequence number and the seal before it. Removing or reordering one breaks every link after it.
03Seal verification
HMAC-SHA256, recomputed on read and on demand. The Integrity page re-verifies the whole trail every time it opens.
04Policy-controlled tool calls
The gateway evaluates halt, rules and defaults before a call reaches the tool. Denied calls are recorded too — an attempt is evidence.
05Human approval gates
Held calls wait for a person and fail closed: no answer in time means refused. The decision and the decider are sealed with the call.
06Independent verification
Exports carry an Ed25519-signed checkpoint. An auditor verifies offline with a key they hold, so the proof doesn't depend on trusting us.

Give your agents a ledger.

Get started Documentation Free to start · no card