How is AER different from observability or logging tools?

Observability and logging give you records you have to trust the vendor about; they live in a system you control and anyone with access can change them. AER produces a signed record that a third party can verify without trusting you or the vendor. The signature and the public transparency log make it evidence rather than a dashboard. AER sits alongside your observability stack; it is the record you hand to someone who will not take your word for it.

The flight recorder for AI agentscollector on npm ↗

Do you know what your agents are doing?

Your agents ship code, touch customer data and spend real money. AER shows you what they are doing and turns every run into a signed record your customers, auditors and your own team can verify for themselves, without trusting you or us. Evidence, not another dashboard taken on faith.

Request access Verify a real record Read the docs

$npx @adastracomputing/aer init

Every action an agent takes fires an event. AER records them all and signs the trace.

InstrumentsOpenAI SDKAnthropic SDKVercel AI SDKMCP serversnode:http(s)fetchchild_process

The problem

Autonomy without evidence is a liability

For teams that ship agents to enterprise customers, work under compliance, or run a fleet of agents in production and have to answer for what those agents did.

The incident review

An agent deleted the wrong records at 2 a.m. The postmortem needs to know which tools it called, what it touched and where it sent data. Ordinary logs are scattered and easy to change after the fact. A signed record answers those questions and cannot be quietly edited.

The audit request

A customer audit asks you to prove what your agents did with their data. Screenshots of your own dashboard are not proof. A signed record that the customer can verify themselves is.

The unknown agent

Someone on the team wired an agent to production last quarter. Nobody remembers which credentials it holds. AER's discovery surfaces agent-like activity you never registered.

How it works

Record. Prove. Control.

Record

Drop-in collector captures what agents do: LLM calls, tools, network, processes. Metadata only, never prompts or bodies.

node --import @adastracomputing/aer-auto-node/register

Prove

Every run becomes a signed bundle anchored to a public transparency log. Anyone can verify it without trusting us.

Ed25519 signatures, anchored to Sigstore Rekor

Control

Protected resources admit only agents that carry a live AER attestation. Unregistered agents are denied at the door.

Short-lived attestation tokens verified at the resource

The bundle: open a real record, verifiable by anyone, offline (verifier).

The collector (npm): presents attestation to protected resources.

Live proof

A signed record, verifiable end to end

First what the agent did, then the proof. Below is the observed activity and the integrity block of a sample AER, signed and anchored by the same production pipeline your own records use. The full canonical bundle (events, execution graph, metadata) is what gets signed and anchored. Verifiable without trusting this dashboard.

The public proof page for a production AER: cryptographically verified, bundle metadata, Rekor log index and the independent verification commands

The public proof page for this record. Every AER gets one. →

The live integrity block for this record is loading, or the API is briefly unreachable. The record itself is unchanged: its canonical hash, Ed25519 signature and public transparency anchor are all checkable independently, so you never have to trust this page. Open the record and check it yourself.

For platform and product teams

The answer to 'is the agent rollout safe?'

AER turns every agent run into a signed record of the tools it called, the systems it touched and the models it used. Your customers and auditors can check it themselves; nobody has to take your word for it.

Ship agents with a rollback story.

Every run is recorded, so promoting an agent from staging is a decision you can defend and reverse.

Answer compliance requests the same day.

Export the evidence pack for any run: canonical bundle, provenance graph, verification script, public key.

Catch drift before customers do.

A trained baseline flags new tools, new domains and new call patterns as findings, delivered by webhook.

Know your inventory.

Discovery lists the agents you registered and surfaces the ones you did not.

Admission control

Turn evidence into a gate

Protected resources can require a live AER attestation before serving a request. Registered agents running the collector present short-lived signed tokens; anything else is denied. Scopes, DPoP proof-of-possession and mTLS binding are available where you need stronger guarantees. Enforcement happens at your resource, so AER is never in your request path.

import { honoMcpGuard } from '@adastracomputing/aer-mcp-guard/hono';

app.use('/mcp', honoMcpGuard({ audience: 'mcp://payments-prod' }));

Evidence, not logs

Independent evidence, not better logs

Plain logs and vendor dashboards both leave the customer trusting that the operator faithfully recorded and presented what happened. AER produces an artifact anyone can verify offline, without trusting AER or the dashboard.

Property	Plain logs	Vendor dashboard	AER
Tamper-evident	—	—	Ed25519 signed
Independently verifiable	—	—	SubtleCrypto, CLI, anywhere
Anchored to public log	—	—	Sigstore Rekor
Baseline-driven detection	grep	proprietary rules	rules.v1 (open + replayable)
Standalone bundle artifact	—	vendor lock-in	single canonical.json
Schema is open	—	—	documented + zod-validated

Integration

The integration is a few lines

The zero-code path instruments a Node agent without touching its source. A TypeScript and Node SDK ships today, a Python SDK is next and raw HTTP works for everything else.

Zero-code (Node)

npx @adastracomputing/aer init

# then run your agent with the collector attached:
node --import @adastracomputing/aer-auto-node/register your-agent.js

TypeScript / Node SDK

npm install @adastracomputing/aer-sdk-ts

import { createAerClient } from '@adastracomputing/aer-sdk-ts';

const client = createAerClient({
  baseUrl: 'https://api.aer.run',
  sessionId: sess.agent_session_id,
  ingestToken: sess.ingest_token,
});
await client.emit('tool.started', { tool: 'web_search', query: 'today' });
await client.emit('tool.completed', { tool: 'web_search', results_count: 5 });
await client.complete();

Or speak the API directly

POST /v1/sessions               → { agent_session_id, ingest_token }
POST /v1/sessions/<id>/events   → ingest one batch (200 OK)
POST /v1/sessions/<id>/complete → { aer_id, canonical_hash, signing_key_id }

# Anyone can verify the resulting bundle, anywhere:
aer verify <aer-id>
# → { verified: true, hash_match: true, signature_valid: true, anchored: true }

Full quickstart →

Trust and security posture

What we claim and what we refuse to

The collector captures metadata only: model names, token counts, tool names, hosts. Never prompts, completions, arguments, bodies or headers.

Bundles are tamper-evident, not tamper-proof: after signing and anchoring, any modification is detectable by anyone.

AER does not claim to stop a malicious operator who strips instrumentation. For that boundary, protected resources verify attestation and unattested callers are denied.

You can verify every claim on this page yourself, in your browser, right now.

Why now

Agents moved faster than the audit trail

Companies are moving agents from demos into production faster than their audit, security and compliance functions can adapt. The agents are writing code, moving money and touching customer data today.

Every incident review, vendor audit and compliance request now hits the same wall: agent activity is recorded in mutable logs owned by the party being asked the question. Regulated industries already require flight recorders for exactly this situation.

AER is the open, verifiable version of that instrument: signed execution evidence plus admission control, live in production with real anchored records that anyone can check.

AER is built by Ad Astra Computing.

Know what your agents are doing. Prove it to anyone who asks.

Request access Verify a record

Questions

What evaluators ask

What it is

How is this different from observability or logging tools?

Observability and logging give you records you have to trust the vendor about: they live in a system you control, and anyone with access can change them. AER produces a signed record that a third party can verify without trusting you or us. The signature and the public transparency log make it evidence, not a dashboard. AER sits alongside your observability stack; it is the record you hand to someone who will not take your word for it.

What is AER not?

It is not an observability dashboard, a prompt logger or a model evaluation tool. It does not capture prompts, completions or bodies, and it does not judge whether an agent behaved well. It records, signs and lets anyone verify what an agent touched. It does not, on its own, prove the agent's intent or that instrumentation was never bypassed. Admission control closes the bypass gap by admitting only attested agents to your protected resources.

Who is AER for?

Teams that ship agents to enterprise customers and get asked for proof of what those agents did with customer data, teams working under compliance obligations, and platform teams governing a fleet of agents in production who need attribution and admission control.

What a record proves

What exactly does a signed record prove?

Three things. Integrity: the record was not altered after signing, since any change breaks the canonical hash. Provenance: it was signed under AER's published key, and the transparency log fixes when. Observation: the events in it were captured by the collector during the run. It does not by itself prove the agent could not act outside what was instrumented; that is what admission control and attestation are for.

What does AER deliberately not capture?

The collector records metadata only: model names, token counts, tool names, hosts and process names. It never captures prompts, completions, tool arguments, request or response bodies or headers. That boundary is enforced in the collector, on every provider, streaming or not, and the API discards unrecognised fields at ingest so nothing else is stored.

Can I prove a specific prompt or output without revealing it?

Yes. Content commitments put a one-way tag over a prompt or response in the signed record using a key only you hold. Later you can prove a given text matches the tag byte for byte, offline, without AER ever seeing the text.

Security and data

Where does my data live and how is it handled?

On Cloudflare's platform, isolated per tenant. You control retention and whether records are public or private. We are a data processor for your telemetry and a controller for your account data. A Data Processing Agreement is available on request, EU and UK transfers rely on Standard Contractual Clauses, and every subprocessor is listed on the subprocessors page. The privacy and security pages have the detail.

Do you have SOC 2 or other certifications?

Not yet. AER is an early product and formal certifications are on the roadmap. What exists today is documented and specific: Ed25519 signing over a canonical hash, transparency anchoring in Sigstore Rekor, Argon2id-hashed keys, tenant isolation enforced in application code and the metadata-only capture boundary. A DPA is available on request. The strongest control is that you never have to trust our word: you can verify every record yourself.

What if Sigstore Rekor goes down or rewrites history?

Rekor is run by the Linux Foundation's Sigstore project with independent witnesses and a publicly auditable Merkle tree. Anchoring is best-effort at session close: if Rekor is briefly unreachable, the record is signed and flagged unanchored, then anchored once the log is reachable again. Even without Rekor, the Ed25519 signature alone proves the record was emitted by AER's key.

Integration

How much work is it to add?

For a Node agent, one command wires in the drop-in collector and runs the collector at startup with no code changes. From your own code, the SDK records runs directly. Getting from nothing to a signed record is a four-step quickstart.

Does this slow down my agent?

No. The SDK batches events in memory and posts them asynchronously. Calls to emit() return as soon as the event is queued; flushing runs every 500ms by default. Signing and anchoring happen at complete() time, server-side, not in your hot path.

What can I instrument, and is the SDK open source?

The collector covers the OpenAI, Anthropic and Vercel AI SDKs, MCP servers and raw HTTP, fetch and child processes. One SDK ships today, @adastracomputing/aer-sdk-ts for TypeScript and Node, with a Python SDK next; the client packages are published and their source is available. Any language can speak the raw HTTP API in the meantime.

How long are records retained?

Records are retained until you delete them, and you set your own retention window in settings. The transparency log entry is permanent by design, since Rekor is append-only, but it contains only a hash and a signature, never your data.

Are the signatures post-quantum?

Not yet. Records are hashed with SHA-256, which retains strong preimage resistance against known quantum attacks, and signed with Ed25519. A hybrid migration to standardised post-quantum signatures is on the roadmap for new records, and historical records can be re-anchored under new schemes. The Rekor log also provides append-only temporal evidence independent of any signature scheme.

The company

What does it cost?

AER is a paid product. During the pilot we scope pricing with each team based on volume and how you use it, so there is no standard price list yet. Request access and we will follow up.

Why now?

Agents are being handed real credentials, budgets and production access faster than the means to govern them. When an agent acts, the questions that follow, what did it touch and can you prove it, are new, and logs were not built to answer them to someone who does not trust you. AER is the record for that moment.