Knot | Signed Audit Trail for AI Agents

Choose the audience that matches your question

The page contains three selectable readings of the same subject.

When a helper looks something up, writes a reply or saves work, Knot keeps the action and its result together. Each new note is tied to the one before it, so the full sequence remains clear and later changes cannot hide.

If someone asks why a helper made a choice, nobody has to reconstruct the story from memory. The sealed trail shows the exact sequence, hides sensitive details and lets a second person check what happened. The answer comes from the original run, not a summary written after the fact.

Knot creates the evidence as the agent works, instead of asking teams to reconstruct it weeks later. It captures actions and results, masks supported secrets before storage, signs the timeline and exports a portable bundle for the next reviewer.

When an incident starts, the response team works from the original timeline, tool results and file changes. Knot packages that evidence with its signed root, so an internal reviewer or third party can verify the sequence offline instead of debating a reconstructed account.

Knot records an agent run as it happens, masks supported secrets, links events into a signed Merkle structure, and exports a portable bundle. A reviewer can reconstruct and verify the run offline with the public key.

Signed agent record. Read the log at any past point.

Reasoning certificates any verifier checks offline, in linear time.

Append-only, hash-chained event provenance with no quiet edits.

Create the first signed run, export its evidence bundle and verify the result offline with only the public key. The producer and reviewer never have to share trust.

Two questions decide procurement: where does it run, and who controls it. Knot runs on the hardware you already own, on premise or in a European region, so the ledger stays inside a border you choose. You hold the signing key, and verification needs only the public half, so sovereignty is the default rather than an upgrade you negotiate for.

The operational gain is fewer hours rebuilding history. The audit trail is created as the agent works, an incident team gets the exact chronology immediately, and an external reviewer can verify the same portable evidence without access to the production service.

The reason to care is a durable record, not a dashboard. Knot keeps a signed, time-ordered record of what your AI agents do, and a third party can verify it offline. Whether that record satisfies a legal or regulatory obligation depends on the applicable requirement and how your organisation uses it.

It is fair to wonder whether something like this is yours to manage. It is not. Knot works behind the helper and keeps the record without interrupting what you are doing. You receive the benefit when a question needs a clear, checkable answer.

You do not have to understand how it works to enjoy what it does. Think of it like a numbered receipt book or a second person counting the till. You never see the work, but you can trust the result because it was made hard to fake. Here are four plain reasons it matters.

Keeps a record nobody can quietly change

You will never use this yourself. But it is a small, careful thing that helps keep an honest record of what computer helpers do in your name. Here is the whole idea, one simple step at a time, with an everyday example for each one.

A hosted trace viewer records what a run did. An evaluation service keeps results in the infrastructure that produced them. An observability proxy sits beside the traffic. A database audit log is a row in a table somebody can still update. None of them signs an event, produces a Merkle root, or supports offline verification. Knot is write-optimised for verifiability: the design centre is the signed event, not the dashboard.

The knotd daemon exposes commit_event, replay, and subscribe tools, plus knot:// resources, over the spec-compliant MCP Streamable HTTP transport, with a stdio bridge for local editor attach. Bearer-token auth uses constant-time comparison. The knot CLI mirrors the same operations with typed exit codes for shell-friendly scripting.

Projections are materialized read views of the log. The ProjectionSet hot-refreshes them on a one-second default interval, with cold refresh on read. Every projection is deterministic: replaying the same events through it must produce the same bytes, which is what makes a replay attestation meaningful.

The redaction pipeline walks every event JSON shape before storage and replaces credentials and PII with hash-stable placeholders. Redaction is applied at ingest, never on output, so the daemon never holds the unmasked data in the first place. The key matcher is whole-word, so donation_token does not match token.

Every event is signed over its canonical encoding, so the signature is portable across languages and survives a different serialiser. Verification is offline and needs only the public key, which is why a downstream consumer never has to trust the process that produced the record.

Every state change in the agent lifecycle is captured as an immutable Event, LLM calls, tool calls, messages, file edits, state snapshots, branch moves. Each carries a deterministic BLAKE3 content id, so re-ingesting the same event is a no-op. The leaf hashes feed a per-run Merkle tree, and its single root is what an attestation signs.

Knot is a self-hostable, offline-verifiable event log for AI agent runs. Events pass through redaction into storage, become read views, and are exposed through one authenticated endpoint. Each step has one job, so the path from emitted event to provable bundle is easy to follow and audit.

The verifier is a separate binary. It trusts nothing it cannot recompute from the raw events.

VERDICT: VERIFIED, ledger is authentic and unaltered

verify an exported run bundle against a public key

The whole promise is offline verifiability. Export a run to a portable bundle, hand it and a public key to a third party, and they re-derive every Merkle root from the raw events, check every signature, and reach a verdict. No service, no network and no trust in the producer. This is the verifier output.

Agent trace, data record, pipeline inventory

Knot keeps a signed, time-ordered record of what your AI agents do. It shows the steps, data references and pipeline components present in a run, and a third party can verify the whole history offline without trusting a hosted service. Use the resulting record alongside the legal, policy and operational controls that apply to your organisation.

Keeps an honest record of what an AI did

When a computer helper does things for you, somebody should be able to look back later and see exactly what it did, in order, with nothing quietly changed. Knot writes down each step, locks the steps together, seals them, and lets a second person check the whole record without having to trust the first.

Separate offline binary, public key only

Knot is a signed, content-addressed event log for AI agent runs. Every entry carries its own identity, every run keeps its own Merkle root, and a third party can verify the history on a laptop with the public key. The event log, redaction, read views, replay statement, offline checker and endpoint travel together as one record system.

The event is written while the agent acts

A simple record of what happened, in order

People remember differently, and important details disappear

Each action, result and change remains in order

A Knot export is not an opaque archive or a dashboard somebody has to keep online. The manifest, run index, event files, read trail and signature travel together, so a reviewer can inspect the shape before running the checker.

The recipient gets the record, not access to your system.

One record, read by your auditor, your customer, and a regulator alike.

What you must show, and what Knot hands you.

Every model call, tool call, and file edit is on the ledger.

A bill of materials for what the AI actually did.

A third party verifies the whole history offline on a laptop.

A record an outsider can check, not just trust.

Personal data is masked at ingest, the trail stays intact.

Evidence of what data was touched and when.

A signed, time-ordered record of every step the agent took.

Provable traceability of automated decisions.

Each event carries a deterministic BLAKE3 id, so re-ingesting the same event is a no-op. Edit one event and its leaf changes, the root changes, and the offline verifier reports a broken chain.

An agent audit log you can hand to a stranger

Knot is source-available software for AI agent audit logs: a signed, content-addressed event log for agent runs. Every step is a typed entry, signed where it is written, and each run carries its own Merkle root. A separate checker verifies the resulting folder offline, without a service, network or database.

Knot is source-available software for AI agent audit trails. When a counterparty, auditor or regulator asks what your automated software did, hand them a signed, tamper-evident record. They can verify it offline with a public key, without access to your systems or a live service. The repository and its documentation go public on 1 September 2026, in the first round of Dweve's foundation release programme.