About Attested Intelligence

Built and maintained by the founder.

Jack Brennan founded Attested Intelligence Holdings LLC to build verifiable records for agent tool decisions. Based in the United States, the company maintains the AGA format, reference implementation and verification tools.

The work is before its first external pilot. Published code and company-authored tests are available for technical inspection.

Contact the founder Inspect the current case

Working together

Start with the review question.

A proposed evaluation begins with the record a recipient needs and the decision it should support. First inspect the static case, then decide whether an integration would answer that question.

Fees, schedule, support and acceptance criteria are agreed before work begins. No production support commitment follows from downloading a public package.

The company also maintains VerifyBundle, a separate tool for portable file and text records. VerifyBundle and AGA have different formats and verifiers.

Discuss a technical evaluation

Available now

Published code and evidence.

The public materials include a receipt format, a reference proxy, offline verification tools and conformance fixtures. Static checks are available now; runtime integration requires a separate deployment review.

Published components and dated test results

aga-mcp-server 3.6.6, the reference implementation: The reference proxy evaluates covered tool-call requests against a hash-bound policy and signs recorded decisions. Version 3.6.6 constructs export proofs from shared tree levels and retains the 3.6.5 transport, policy and expected-key controls, with isolated qualification and npm provenance. It remains a reference implementation without authenticated clients, privileged key custody, filesystem containment or complete MCP relay support. The security page distinguishes current limits from historical findings.
aga-verify 2.2.3, the offline verifier: A zero-dependency checker a reviewer runs on their own machine against an evidence bundle, with no network and no callback.
The published format and its corpus: The receipt and bundle specification, plus the conformance corpus that holds implementations in three toolchains to the same verdicts.
Dated runtime tests and the cross-stack corpus: Verdicts stay identical across three toolchains (JavaScript, Go, Python) on all 61 classical cross-stack cases as the harness feeds them (it re-serializes the parsed cases, so the leaf_index case spelled 0.0 runs as an integer; see /spec), and two oracles in different languages agree on all 28 post-quantum composite cases. Recomputed September 21, 2026 from the release CI run that published 3.6.0.

These are company-authored implementations and measurements, not independent certification. Check source and release provenance; read the known limitations.

Boundary

The record is not the whole deployment.

A verified record checks signed commitments against an expected key. It does not establish complete capture, tool execution, freshness or resistance to bypass.

Technical scope and receipt exceptions

What verification proves, and does not

A verified bundle proves the integrity of every receipt present, as the verifier parses it: a field name repeated in the file still verifies, because the verifiers read the last copy (known issue 5 on /security). It does not prove the operator recorded every action.
A PERMITTED receipt records a governance decision, with two exceptions. A receipt whose tool_name is "(passthrough)" records an MCP method the gateway passed toward the upstream without evaluating it, and does not prove the upstream received it. An aga-mcp-server measure_behavior receipt records a drift finding, marked PERMITTED when the finding is not enforced. A receipt does not prove the tool call executed, or what it returned.
Receipts prove decisions were recorded and signed. They do not prove the agent could not bypass the gateway; interception placement is a deployment property.

The agent lacks the gateway signing key only when it runs under an OS identity that cannot read the gateway’s secrets. Routing, key custody, retained exports and response actions are deployment responsibilities. Process separation alone does not establish that boundary.

AGA means Attested Governance Artifacts. The patent-pending work also describes a broader architecture called cryptographic runtime governance; private reference components and design blueprints are labeled separately from the public packages.

Identity and history

The company record.

Entity details and publication history

Entity: Attested Intelligence Holdings LLC
Illinois file no.: 17233815
USPTO application: 19/433,835
Domain registered: 2025-12-25
GitHub account: 2025-12-25
First npm publish: 2026-03-05 · aga-mcp-server
First PyPI release: 2026-03-20 · aga-governance
First verifier publish: 2026-06-02 · aga-verify

Dates above record first appearances, not current versions. The source register was checked September 18, 2026. Package and account sources are linked on provenance; application details are on the patent page. Pending does not mean granted.

Start with a static sample.

Download the bundle and verifier, check the published fixture key and try a wrong-key control. No agent runtime is needed for this first task.

Static evaluation Technical architecture System walkthrough