Technical evaluation
Inspect a record.
Challenge the result.
Check the signed fixture below, then change a decision or the expected key. Reproduce the check locally with the downloadable verifier. No account, live gateway or running agent is needed.
The sample tests the record, not runtime enforcement. Integration is a separate, supervised evaluation after the deployment risks have been reviewed.
Start here
Check the signed decisions.
Do these recorded decisions verify against the expected key, and what policy reference do they commit to? Use the original fixture, then challenge the check.
Synthetic reviewer case · September 30, 2026
Verify this fixture
The recorded decisions and checkpoint are unchanged. Check them against the published fixture key.
Inspect the recorded decisions
These are signed policy decisions about tool requests, not model reasoning or evidence that a tool executed.
read_document- PERMITTEDSynthetic allowlist permits this named tool.
write_file- DENIEDSynthetic allowlist disallows this named tool.
Expected fixture key and its source
ab1c6c3dbc49c942d424f6b39ca6e658fe5d439e255e6efdd0427ef3fab4fbf5
The company publishes both the fixture and its key. This example checks that pair. For another producer, obtain the expected key through a separately trusted channel.
View raw JSON for this check
{
"schema_version": "2.0",
"bundle_id": "rcpt-6fb707dd-6fdf-4796-be85-52dbadae7ed7",
"algorithm": "Ed25519-SHA256-JCS",
"generated_at": "2026-09-30T09:50:30.972Z",
"gateway_id": "synthetic-reviewer-case",
"public_key": "ab1c6c3dbc49c942d424f6b39ca6e658fe5d439e255e6efdd0427ef3fab4fbf5",
"policy_reference": "af508edbe7a479f752d6f4f29cfb7900e58250cce4fc58909e1010d47d3846f4",
"receipts": [
{
"receipt_id": "rcpt-ae5cfc8c-58e6-493e-a75f-67467e09cfc2",
"receipt_version": "1.0",
"algorithm": "Ed25519-SHA256-JCS",
"timestamp": "2026-09-30T09:50:30.969Z",
"request_id": "review-1",
"method": "tools/call",
"tool_name": "read_document",
"decision": "PERMITTED",
"reason": "Synthetic allowlist permits this named tool.",
"policy_reference": "af508edbe7a479f752d6f4f29cfb7900e58250cce4fc58909e1010d47d3846f4",
"arguments_hash": "3362e0e64ef7e058e762d61c99ca030c6350d137bc7b66e7080bccbb62670fc0",
"previous_receipt_hash": "",
"gateway_id": "synthetic-reviewer-case",
"public_key": "ab1c6c3dbc49c942d424f6b39ca6e658fe5d439e255e6efdd0427ef3fab4fbf5",
"signature": "d3982755df7a0da07239199af6ce221c6b7a72069c917b7cc835c0bfbf91d98c196668248a386c75afe657c72f64c43b5935cb641d717df8870bd823904ea70c"
},
{
"receipt_id": "rcpt-39421ed2-e0e0-4924-8d14-ad5a659a5384",
"receipt_version": "1.0",
"algorithm": "Ed25519-SHA256-JCS",
"timestamp": "2026-09-30T09:50:30.972Z",
"request_id": "review-2",
"method": "tools/call",
"tool_name": "write_file",
"decision": "DENIED",
"reason": "Synthetic allowlist disallows this named tool.",
"policy_reference": "af508edbe7a479f752d6f4f29cfb7900e58250cce4fc58909e1010d47d3846f4",
"arguments_hash": "7218bf8531356100f6f41041380ac5f61c75bddb4ad3479da9bba9c4721fa767",
"previous_receipt_hash": "0295bb80d45137334eaaebec1281a07212c8592c7d0d5406c11b60de78eaa446",
"gateway_id": "synthetic-reviewer-case",
"public_key": "ab1c6c3dbc49c942d424f6b39ca6e658fe5d439e255e6efdd0427ef3fab4fbf5",
"signature": "aaca51125f6968dbcb83b0fe8edbdfe1efa205795db7296d285eaa0692a08ea9e75181235db645ccb5498d7d03b3fef53c17b8970016674e3143f37bb8bcca0e"
}
],
"merkle_root": "4e5a1638cf33c1351eb3cf77f429903e4f34ed540037f9ddfd71c4d6da7b8791",
"merkle_proofs": [
{
"leaf_hash": "0295bb80d45137334eaaebec1281a07212c8592c7d0d5406c11b60de78eaa446",
"leaf_index": 0,
"siblings": [
"a1e396312d36cbaa680704ff3821a0a76fd1b2c40500ac638182a48b0c41df53"
],
"directions": [
"right"
],
"merkle_root": "4e5a1638cf33c1351eb3cf77f429903e4f34ed540037f9ddfd71c4d6da7b8791"
},
{
"leaf_hash": "a1e396312d36cbaa680704ff3821a0a76fd1b2c40500ac638182a48b0c41df53",
"leaf_index": 1,
"siblings": [
"0295bb80d45137334eaaebec1281a07212c8592c7d0d5406c11b60de78eaa446"
],
"directions": [
"left"
],
"merkle_root": "4e5a1638cf33c1351eb3cf77f429903e4f34ed540037f9ddfd71c4d6da7b8791"
}
],
"checkpoint": {
"algorithm": "Ed25519-SHA256-JCS",
"gateway_id": "synthetic-reviewer-case",
"generated_at": "2026-09-30T09:50:30.972Z",
"head_leaf_hash": "a1e396312d36cbaa680704ff3821a0a76fd1b2c40500ac638182a48b0c41df53",
"leaf_count": 2,
"merkle_root": "4e5a1638cf33c1351eb3cf77f429903e4f34ed540037f9ddfd71c4d6da7b8791",
"signature": "9538a8b128f33cdcfeeb2d94e06001d4b493621ba17e6ae3ab8f8ec7cc17fbebe229916194f20ceb00a4fe4b0b96d89d4f0b4ef821c62c02cb89e49c7e424b05"
},
"offline_capable": true
}Policy, requests and expected decisions
The supplied policy permits read_document and denies write_file. No model, running proxy or tool was used to produce this synthetic case.
Policy reference: af508edbe7a479f752d6f4f29cfb7900e58250cce4fc58909e1010d47d3846f4
Reproduce it locally
Download and extract the case into a new folder. With a maintained Node.js release, run the included zero-dependency verifier. The README includes the changed-decision, wrong-key and missing-key-value controls, their expected exits and the complete scope.
node verify.mjs evidence-bundle.json --pubkey ab1c6c3dbc49c942d424f6b39ca6e658fe5d439e255e6efdd0427ef3fab4fbf5Expected: VERIFIED with the expected test key, exit 0. A changed signed decision or well-formed wrong key fails with exit 1. A supplied key flag with no value is a usage error, exit 2. Omitting the key intentionally checks integrity only.
Both signed receipts commit to the supplied policy reference. This named-tool predicate is intentionally small; its hash does not prove policy correctness. The test key is hosted with the fixture, not independently authenticated. Timestamps are self-reported. A pass does not establish execution, complete capture or freshness.
Historical fixture and reproduction instructions
Published fixture · June 2, 2026
Verify this fixture
The recorded decisions and checkpoint are unchanged. Check them against the published fixture key.
Inspect the recorded decisions
These are signed policy decisions about tool requests, not model reasoning or evidence that a tool executed.
search_web- PERMITTEDtool permitted by allowlist
read_file- PERMITTEDtool permitted by allowlist
write_file- DENIEDpath "/etc/shadow" outside allowed prefix "/data/"
execute_command- DENIEDtool explicitly disallowed
Expected fixture key and its source
b900a315c50d9516c4efcb7a2300c25c602855eac8aa3b5a9d0939234d738ebe
The company publishes both the fixture and its key. This example checks that pair. For another producer, obtain the expected key through a separately trusted channel.
View raw JSON for this check
{
"schema_version": "1.0",
"bundle_id": "f51585b6-57c0-4dab-84fb-4dbd6d917a5e",
"algorithm": "Ed25519-SHA256-JCS",
"generated_at": "2026-06-02T00:00:00Z",
"gateway_id": "aga-demo-001",
"public_key": "b900a315c50d9516c4efcb7a2300c25c602855eac8aa3b5a9d0939234d738ebe",
"policy_reference": "fc126a9eddac17084bb6c12114932b1e9e7ade9429ca107c6d9f64554c715a7d",
"receipts": [
{
"receipt_id": "ee6f314e-3c80-4d1d-8a3d-27787fa76fb9",
"receipt_version": "1.0",
"algorithm": "Ed25519-SHA256-JCS",
"timestamp": "2026-06-02T00:00:00.000Z",
"request_id": "1",
"method": "tools/call",
"tool_name": "search_web",
"decision": "PERMITTED",
"reason": "tool permitted by allowlist",
"policy_reference": "fc126a9eddac17084bb6c12114932b1e9e7ade9429ca107c6d9f64554c715a7d",
"arguments_hash": "4db16118ecc964123316f1ddca6f152afb892db6eb8c9cd2b61f6c7f6d0ba07b",
"previous_receipt_hash": "",
"gateway_id": "aga-demo-001",
"public_key": "b900a315c50d9516c4efcb7a2300c25c602855eac8aa3b5a9d0939234d738ebe",
"signature": "df655baf85e699561b8f4ace3cccbe7c164976e4c7325256ed8b19bb8f330b42272e1f6c66b6c26c470119c730172f633813222256b26108fa26d41cb4bfee04"
},
{
"receipt_id": "10499e6c-cb5e-46ef-bbbb-da6295de5f91",
"receipt_version": "1.0",
"algorithm": "Ed25519-SHA256-JCS",
"timestamp": "2026-06-02T00:00:00.211Z",
"request_id": "2",
"method": "tools/call",
"tool_name": "read_file",
"decision": "PERMITTED",
"reason": "tool permitted by allowlist",
"policy_reference": "fc126a9eddac17084bb6c12114932b1e9e7ade9429ca107c6d9f64554c715a7d",
"arguments_hash": "0b977ff0042c4f8af8997f31bdec91ba2751d5326093e4249d6b1b9279478acb",
"previous_receipt_hash": "333b23234aa84559a1e5cf16fde669c85a296277234e63dedd3f1a0be63321a8",
"gateway_id": "aga-demo-001",
"public_key": "b900a315c50d9516c4efcb7a2300c25c602855eac8aa3b5a9d0939234d738ebe",
"signature": "d623ec9d7a0678615084a023d7e5c57f0c463f0ffe6635180962ab7dfb7796d8493359070176ce37e64b578bdc3011f133f3808f9b7f2d94ece54cbba9478e0e"
},
{
"receipt_id": "ee9201f1-7ca9-4d28-b393-93cd45320670",
"receipt_version": "1.0",
"algorithm": "Ed25519-SHA256-JCS",
"timestamp": "2026-06-02T00:00:00.422Z",
"request_id": "3",
"method": "tools/call",
"tool_name": "write_file",
"decision": "DENIED",
"reason": "path \"/etc/shadow\" outside allowed prefix \"/data/\"",
"policy_reference": "fc126a9eddac17084bb6c12114932b1e9e7ade9429ca107c6d9f64554c715a7d",
"arguments_hash": "11006ae39f09b1605487799d91b28fc328f01be8954034aaea1569b87a66a087",
"previous_receipt_hash": "68e71b8f1c788a4fc6d4dcbb69d834d9829d51277a6ffb09acf11aeb40a7033d",
"gateway_id": "aga-demo-001",
"public_key": "b900a315c50d9516c4efcb7a2300c25c602855eac8aa3b5a9d0939234d738ebe",
"signature": "8813f8b8739845ea4206f4978c932d58465c0769ef03054df3ce15a7360d5f043b7704f7b7c842db6dffddd39382a30d0c197332128aac601485e8ef3626790f"
},
{
"receipt_id": "b06354ba-a185-4e56-a24d-fcac7e39ecf6",
"receipt_version": "1.0",
"algorithm": "Ed25519-SHA256-JCS",
"timestamp": "2026-06-02T00:00:00.633Z",
"request_id": "4",
"method": "tools/call",
"tool_name": "execute_command",
"decision": "DENIED",
"reason": "tool explicitly disallowed",
"policy_reference": "fc126a9eddac17084bb6c12114932b1e9e7ade9429ca107c6d9f64554c715a7d",
"arguments_hash": "95c07bad485990c5b225ac04ccc725d2288c16c688f7f9274bf8cc98f5c24d41",
"previous_receipt_hash": "24fc6dca36f4a89c4e33e626747b3bdb7c9edd989b16b616b4a6746818f7e071",
"gateway_id": "aga-demo-001",
"public_key": "b900a315c50d9516c4efcb7a2300c25c602855eac8aa3b5a9d0939234d738ebe",
"signature": "8b698df86d16161958b3120491433d48175b9da669338bdafb2ef3885416164790f7be46fd0a8850326c519272028d168efeeb3de8492fadca9a073078a2d205"
}
],
"merkle_root": "8dad974e71d9e6c503f98b27190810504201c986e1b1f4084d2bee7e06cc73ac",
"merkle_proofs": [
{
"leaf_hash": "333b23234aa84559a1e5cf16fde669c85a296277234e63dedd3f1a0be63321a8",
"leaf_index": 0,
"siblings": [
"68e71b8f1c788a4fc6d4dcbb69d834d9829d51277a6ffb09acf11aeb40a7033d",
"d3a6fd4150a0f63be852799f26dfc1b40651bf3f256208ac30b65951ad5e72db"
],
"directions": [
"right",
"right"
],
"merkle_root": "8dad974e71d9e6c503f98b27190810504201c986e1b1f4084d2bee7e06cc73ac"
},
{
"leaf_hash": "68e71b8f1c788a4fc6d4dcbb69d834d9829d51277a6ffb09acf11aeb40a7033d",
"leaf_index": 1,
"siblings": [
"333b23234aa84559a1e5cf16fde669c85a296277234e63dedd3f1a0be63321a8",
"d3a6fd4150a0f63be852799f26dfc1b40651bf3f256208ac30b65951ad5e72db"
],
"directions": [
"left",
"right"
],
"merkle_root": "8dad974e71d9e6c503f98b27190810504201c986e1b1f4084d2bee7e06cc73ac"
},
{
"leaf_hash": "24fc6dca36f4a89c4e33e626747b3bdb7c9edd989b16b616b4a6746818f7e071",
"leaf_index": 2,
"siblings": [
"be4146693a20c2840f1a881622f467ef306e190bf2a8c67594f09f7ba9a560bf",
"d81d6e505d6e4f7d3835cb3e169c837e4ae6047315626e01878a9dd159117734"
],
"directions": [
"right",
"left"
],
"merkle_root": "8dad974e71d9e6c503f98b27190810504201c986e1b1f4084d2bee7e06cc73ac"
},
{
"leaf_hash": "be4146693a20c2840f1a881622f467ef306e190bf2a8c67594f09f7ba9a560bf",
"leaf_index": 3,
"siblings": [
"24fc6dca36f4a89c4e33e626747b3bdb7c9edd989b16b616b4a6746818f7e071",
"d81d6e505d6e4f7d3835cb3e169c837e4ae6047315626e01878a9dd159117734"
],
"directions": [
"left",
"left"
],
"merkle_root": "8dad974e71d9e6c503f98b27190810504201c986e1b1f4084d2bee7e06cc73ac"
}
],
"checkpoint": {
"algorithm": "Ed25519-SHA256-JCS",
"gateway_id": "aga-demo-001",
"generated_at": "2026-06-02T00:00:00Z",
"head_leaf_hash": "be4146693a20c2840f1a881622f467ef306e190bf2a8c67594f09f7ba9a560bf",
"leaf_count": 4,
"merkle_root": "8dad974e71d9e6c503f98b27190810504201c986e1b1f4084d2bee7e06cc73ac",
"signature": "f446abb9945d425c2c5b249124c9f5b1d2655f991119c5ba41d82203342dce9d0ea4018c1b7f4339a84e204daf89f23f03c971b1966e180097db7d5e5ec60609"
},
"offline_capable": true
}The interactive check uses the same verification engine as the bundle verifier. To explore additional mutations, use the tamper demonstration. The site hosts the fixture and key; this does not independently authenticate the producer.
Tier 1 · self-serve
Verify the static sample.
The ZIP contains evidence-bundle.json, a zero-dependency verify.mjs and a README. Extract it into a new folder. The verifier uses Node.js built-in cryptography; use a maintained Node.js release. Its implementation minimum is Node.js 18, not a recommendation to use an unsupported release. No package installation is needed for this path.
1. Check the download
Compare the ZIP's SHA-256 against the published digest. This detects a changed download; a digest hosted beside the file is not independent issuer authentication.
# PowerShell, in the download folder Get-FileHash -Algorithm SHA256 .\sample-bundle.zip Expand-Archive -LiteralPath .\sample-bundle.zip -DestinationPath .\aga-sampleUse a new destination. Then open a terminal in the extracted folder.
2. Verify against the fixture key
node verify.mjs evidence-bundle.json --pubkey b900a315c50d9516c4efcb7a2300c25c602855eac8aa3b5a9d0939234d738ebeExpect PASS and exit code 0. This key belongs to the published fixture, not the live demo gateway. Both the fixture and this key are company-hosted. For a partner's evidence, obtain the expected gateway key through a separate trusted channel before checking the file.
3. Run two negative controls
Change a character in the expected key and repeat the command. Then restore the correct key, make a copy of the JSON file, and change a receipt's
Try signed-field tampering in the browsertool_name. Both checks must fail. Do not edit the original fixture or mistake an unsigned envelope field for a signed field.
Download preparation on macOS or Linux
In the download folder, compare the digest with the linked published value. Extract into a new folder, then use the same verification command and expected key above.
# macOS
shasum -a 256 sample-bundle.zip
# Linux
sha256sum sample-bundle.zip
# Either, with unzip available and a new destination
unzip sample-bundle.zip -d aga-sample
cd aga-sampleUse a published package instead
These commands may download packages on first use. Installation is not an offline operation. After installation, verification reads the local file without a gateway call.
# JavaScript verifier: put --pubkey AFTER the file
npx -y @attested-intelligence/aga-verify@2.2.3 evidence-bundle.json --pubkey b900a315c50d9516c4efcb7a2300c25c602855eac8aa3b5a9d0939234d738ebe
# Python verifier, preferably in a virtual environment
python -m pip install aga-governance==0.3.2
aga verify evidence-bundle.json --pubkey b900a315c50d9516c4efcb7a2300c25c602855eac8aa3b5a9d0939234d738ebePython versions 0.2.6 and 0.3.0 are yanked because deeply nested input could raise instead of returning FAILED. Version 0.3.1 fixed this; 0.3.2 carries that code. JavaScript and Python can disagree outside the tested corpus. Read the parser and algorithm limitations.
Interpretation
What PASS means.
- The recorded receipts check
- Signatures, hash links, Merkle proofs and the checkpoint agree as the verifier parses them. Duplicate JSON fields retain the last value, so inspect the parsed output. Unsigned envelope metadata, undefined fields and whitespace are not authenticated.
- The pinned key matches
- Issuer assurance depends on how you obtained and trusted that key. Without a pin, a pass checks internal consistency only. A signing-key holder can re-sign a different history.
- It is not a complete activity record
- The bundle cannot reveal actions never recorded, prove that a permitted call executed, or prove that an agent could not bypass the gateway. A passthrough receipt records an unevaluated method, not delivery.
- It does not establish freshness or trusted time
- An earlier genuine export can still pass. Compare an independently obtained checkpoint if freshness matters. Published AGA components use the system clock, not an external time authority.
Trust and scope explains the full boundary. Conformance documentation describes 61 classical cases as the harness feeds them and the separate 28 hybrid cases. Those historical corpus results are not a fresh certification of every package or input.
Tiers 2 and 3 · coordinated evaluation
Test the deployment separately.
Tier 2 observes permitted and denied calls at a synthetic upstream. Tier 3 integrates a partner's selected tool path. Neither runs from this page, and neither follows automatically from a Tier 1 pass. The private evaluation kit is available by arrangement, not as a public self-serve install.
Do not start the gateway on an unisolated workstation.
The published 3.6.6 runtime defaults to a loopback agent listener and adds bounded transport, request ownership, strict policy validation and gateway-key environment filtering. It still speaks newline-delimited JSON-RPC over raw TCP without client authentication. A stdio client needs a relay; SSE or Streamable HTTP needs a compatible bridge. Neither is included. Review network access, unauthenticated local control reads, separate OS identities, key custody and cleanup before any runtime test.
Direct access to the upstream bypasses the proxy. A proxy restart starts a new in-memory chain, so export before stopping. An export can hold governed calls while it runs. A same-account upstream log is an observation, not an independent security witness.
Review current boundaries and all thirteen dated findingsPolicy behavior to understand first
The default permissive profile denies nothing on policy grounds. Policy denial needs standard, restrictive, or a custom policy in allowlist or denylist mode. Example profiles are not sector policies. Only tools/call is evaluated; other methods may pass through unevaluated or without receipts. Some malformed calls are refused without a receipt or response.
Policy modes, parser boundaries and unrecorded calls
Standard allows ten generic example tool names; restrictive allows three, with different rate and path limits. Your server's actual tool names need an explicit policy. In 3.6.6, path and pattern rules apply to allowed entries in allowlist and denylist modes. They inspect top-level string arguments, not nested values; a required path must be a string.
Version 3.6.6 validates policy shape and requires each configured allowed member to be a boolean. Malformed policies are rejected at startup, and inherited object properties are not tool constraints. Audit_only permits valid calls after input validation; it does not bypass tool-name or canonicalization checks. The unsafe coercion behavior of earlier releases is retained on /security as a historical finding.
Malformed policy constraints are rejected before listening in 3.6.6. Invalid tool-name types produce DENIED receipts when the request can be attributed; malformed wire input can be refused before a receipt exists. The earlier affected cases remain in known issue 7 and known issue 10 for exact cases.
Initialization notifications pass without receipts. Other notifications are refused and recorded when attributable in 3.6.6. Unevaluated request methods can still pass through without policy evaluation; receipt coverage depends on the method. This transport is not a complete MCP session, server-request or cancellation relay. Review the version-specific protocol boundary before integrating.
Availability
Published is not the same as production-ready.
- Static verification
- The sample ZIP, browser verifier and aga-verify 2.2.3 check Ed25519 bundles. The browser code is company-authored and runs locally; that is not independent authorship.
- Published runtime 3.6.6
- @attested-intelligence/aga-mcp-server includes aga-proxy. Its live signer uses Ed25519. Hybrid ML-DSA-65 + Ed25519 signing is a library export, not the live default; aga-proxy verify supports hybrid bundles.
- Python SDK 0.3.2
- aga-governance verifies Ed25519 bundles and records decisions supplied by its host code. Its in-process recorder evaluates no policy and holds the signing key in that process.
- Private reference components
- The Go CLI, Kubernetes admission webhook, Helm chart and Envoy integration are request-access reference work. They require a wired deployment; Kubernetes has not been end-to-end validated. Do not treat Go commands such as aga doctor or aga audit as features of the public npm verifier. Read the architecture.
Technical evaluation
Define the question.
Then evaluate the fit.
Bring the tool workflow and the evidence your reviewer needs. Start with the static artifact, then agree whether a separate integration evaluation would answer the question.
- Check the static artifact and identify the reviewer's actual question.
- Agree the tool path, policy, isolation, data handling and expected key.
- Run the approved bounded evaluation and verify exported evidence on the reviewer's machine.
- Document what was useful, what failed and whether to continue.
Attested Intelligence is founder-operated and before its first external pilot. Scope, fees, timing, support and acceptance criteria must be agreed before an engagement. Runtime work depends on a separate readiness review. Any public reference requires permission.
Retain your bundles, expected keys, verifier and dependencies. They can be checked without our service; see continuity requirements.