Do you know what your agents are doing?
Your agents ship code, touch customer data and spend real money. AER shows you what they are doing right now and turns every run into signed evidence that anyone can verify. When something goes wrong, you have answers instead of guesses.
npx @adastracomputing/aer initEvery action an agent takes fires an event. AER records the trace and signs it.
InstrumentsOpenAI SDKAnthropic SDKVercel AI SDKMCP serversnode:http(s)fetchchild_process
The problem
Autonomy without evidence is a liability
01
The incident review
An agent deleted the wrong records at 2 a.m. The postmortem asks what it saw, what it decided and what else it touched. Logs answer none of that and the agent cannot testify.
02
The audit request
A customer audit asks you to prove what your agents did with their data. Screenshots of your own dashboard are not proof. A signed record that the customer can verify themselves is.
03
The unknown agent
Someone on the team wired an agent to production last quarter. Nobody remembers which credentials it holds. AER's discovery surfaces agent-like activity you never registered.
How it works
Record. Prove. Control.
Record
Drop-in collector captures what agents do: LLM calls, tools, network, processes. Metadata only, never prompts or bodies.
node --import @adastracomputing/aer-auto-node/register
Prove
Every run becomes a signed bundle anchored to a public transparency log. Anyone can verify it without trusting us.
Ed25519 signatures, anchored to Sigstore Rekor
Control
Protected resources admit only agents that carry a live AER attestation. Unregistered agents are denied at the door.
Short-lived attestation tokens verified at the resource
For platform and product teams
The answer to 'is the agent rollout safe?'
It turns every agent run into a signed, independently verifiable record of exactly what the agent did, touched and called.
Ship agents with a rollback story.
Every run is recorded, so promoting an agent from staging is a decision you can defend and reverse.
Answer compliance without a fire drill.
Export the evidence pack for any run: canonical bundle, provenance graph, verification script, public key.
Catch drift before customers do.
A trained baseline flags new tools, new domains and new call patterns as findings, delivered by webhook.
Know your inventory.
Discovery lists the agents you registered and surfaces the ones you did not.
Admission control
Turn evidence into a gate
Protected resources can require a live AER attestation before serving a request. Registered agents running the collector present short-lived signed tokens; anything else is denied. Scopes, DPoP proof-of-possession and mTLS binding are available where you need stronger guarantees. Enforcement happens at your resource, so AER is never in your request path.
import { honoMcpGuard } from '@adastracomputing/aer-mcp-guard/hono';
app.use('/mcp', honoMcpGuard({ audience: 'mcp://payments-prod' }));Evidence, not logs
Independent evidence, not better logs
Plain logs and vendor dashboards both leave the customer trusting that the operator faithfully recorded and presented what happened. AER produces an artifact anyone can verify offline, without trusting AER or the dashboard.
| Property | Plain logs | Vendor dashboard | AER |
|---|---|---|---|
| Tamper-evident | — | — | Ed25519 signed |
| Independently verifiable | — | — | SubtleCrypto, CLI, anywhere |
| Anchored to public log | — | — | Sigstore Rekor |
| Baseline-driven detection | grep | proprietary rules | rules.v1 (open + replayable) |
| Standalone bundle artifact | — | vendor lock-in | single canonical.json |
| Schema is open | — | — | documented + zod-validated |
Integration
The integration is a few lines
The zero-code path instruments a Node agent without touching its source. Official SDKs for TypeScript and Python; raw HTTP works for everything else.
Zero-code (Node)
npx @adastracomputing/aer init # then run your agent with the collector attached: node --import @adastracomputing/aer-auto-node/register your-agent.js
TypeScript / Node SDK
npm install @adastracomputing/aer-sdk-ts
import { createAerClient } from '@adastracomputing/aer-sdk-ts';
const client = createAerClient({
baseUrl: 'https://api.aer.run',
sessionId: sess.agent_session_id,
ingestToken: sess.ingest_token,
});
await client.emit('tool.started', { tool: 'web_search', query: 'today' });
await client.emit('tool.completed', { tool: 'web_search', results_count: 5 });
await client.complete();Python SDK
pip install aer-sdk
from aer import AerClient
with AerClient(
base_url="https://api.aer.run",
session_id=sess["agent_session_id"],
ingest_token=sess["ingest_token"],
) as client:
client.emit("tool.started", {"tool": "web_search", "query": "today"})
client.emit("tool.completed", {"tool": "web_search", "results_count": 5})
# __exit__ flushes + completes on clean exitOr speak the API directly
POST /v1/sessions → { agent_session_id, ingest_token }
POST /v1/sessions/<id>/events → ingest one batch (200 OK)
POST /v1/sessions/<id>/complete → { aer_id, canonical_hash, signing_key_id }
# Anyone can verify the resulting bundle, anywhere:
aer verify <aer-id>
# → { verified: true, hash_match: true, signature_valid: true, anchored: true }Trust and security posture
What we claim and what we refuse to
The collector captures metadata only: model names, token counts, tool names, hosts. Never prompts, completions, arguments, bodies or headers.
Bundles are tamper-evident, not tamper-proof: after signing and anchoring, any modification is detectable by anyone.
AER does not claim to stop a malicious operator who strips instrumentation. For that boundary, protected resources verify attestation and unattested callers are denied.
You can verify every claim on this page yourself, in your browser, right now.
Why now
Agents moved faster than the audit trail
Companies are moving agents from demos into production faster than their audit, security and compliance functions can adapt. The agents are writing code, moving money and touching customer data today.
Every incident review, vendor audit and compliance request now hits the same wall: agent activity is recorded in mutable logs owned by the party being asked the question. Regulated industries already require flight recorders for exactly this situation.
AER is the open, verifiable version of that instrument: signed execution evidence plus admission control, live in production with real anchored records that anyone can check.
AER is built by Ad Astra Computing.
Know what your agents are doing. Prove it to anyone who asks.
Operational details
Questions engineers ask first
Does this slow down my agent?
emit() return as soon as the event is queued; flushing runs every 500ms by default. The signing and anchoring happen at complete() time, server-side, not in your hot path.What does AER deliberately not capture?
How long are bundles retained?
What if Sigstore Rekor goes down or rewrites history?
Is the SDK open source?
@adastracomputing/aer-sdk-ts for TypeScript / Node, and aer-sdk on PyPI for Python (stdlib-only, Python 3.10+). Go and Rust are planned once the wire protocol stabilises past v1.