Open Source · Apache 2.0 · 107 Tests Passing

Your agents remember.
Now prove it.

AttestMCP is a transparent proxy that generates tamper-evident audit trails for AI agent memory — so your SOC 2 auditor stops blocking the deal.

View on GitHub → See how it works

$pip install attestmcp

Record #1

tools/call → store_memory

◆ 7c61c0c1e478fa...

──▶

Record #2

tools/call → search_memories

◆ 921266f24548b2...

──▶

Record #3

tools/call → store_memory

◆ 272787bc3bae8c...

──▶

Record #4

tools/call → recall

◆ f8a19d3c72e401...

The Problem

Memory servers remember.
They can't testify.

SOC 2 auditors now ask about AI

Security questionnaires include questions about agent behavior, memory access, and data retention. No audit trail means no attestation.

Enterprise deals die at security review

"We love your AI product, but we can't pass security review." The same conversation, repeated across every Series A/B startup shipping agents.

No evidence for cyber insurance

Carriers require documented AI controls. 33% of organizations lack evidence-quality audit trails for their AI systems.

The gap nobody's filling

Mem0, Zep, Hindsight — great memory. Lunar MCPX, MintMCP — great governance. Zero products combine memory awareness with compliance evidence.

How It Works

One proxy. Zero code changes.

Point your agent at the proxy

Change one URL in your MCP config. Your agent talks to AttestMCP instead of the memory server directly. Requests and responses pass through unchanged.

Every operation gets recorded

Identity extracted from JWT tokens. Request and response hashed. Audit record written to a SHA-256 hash chain before the response returns. Synchronous. No lost records.

Hand the report to your auditor

Run attestmcp report to generate a self-contained HTML evidence report mapped to SOC 2 CC6.1, CC6.3, CC7.2, and CC8.1. Chain integrity verified on every run.

Evidence Format

Every record is auditor-ready

audit_record.json

{
  "record_id": "0192e4a1-7b3c...",
  "timestamp": "2026-04-15T14:32:01Z",
  "agent_identity": {
    "source": "oauth_jwt",
    "user": "deploy-bot@acme.com",
    "agent_name": "support-agent-v2",
    "org": "acme-corp",
    "verified": true
  },
  "method": "tools/call",
  "tool_name": "search_memories",
  "params_hash": "a1b2c3d4e5f6...",
  "policy_decision": "allow",
  "result_hash": "f6e5d4c3b2a1...",
  "chain_hash": "9f8e7d6c5b4a..."
}

CC6.1

Logical Access Controls

Identity on every record — who accessed memory, verified by JWKS or claimed from JWT.

CC6.3

Access Authorization

Policy decisions (allow/deny/escalate/redact) logged with role claims for access reviews.

CC7.2

System Monitoring

Continuous audit trail. Every tool invocation captured with request/response hashes and latency.

CC8.1

Change Management

SHA-256 hash chain. Modify, delete, or reorder any record → chain breaks. Tamper-evident by design.

Architecture

Transparent. Synchronous. Provable.

Agent Memory Server (Claude, GPT, etc.) (Mem0, Zep, etc.) │ │ │ POST /mcp │ ├──────────────▶ ┌─────────────────┐ ────────▶│ │ │ AttestMCP │ │ │ │ │ │ │ │ Extract JWT │ │ │ │ Forward req │ │ │ │ Hash response │ │ │ │ Chain record │ │ │ │ Write SQLite │ ◀────────│ │◀────────────── └─────────────────┘ │ │ response unchanged │ │ │

Your agents remember.Now prove it.

Memory servers remember.They can't testify.