Documentation
AER documentation
AER records what AI agents actually do and turns every run into a signed, independently verifiable record. The client side is open: the collector, the SDK, the verifier and the admission guard are published packages you can read and audit. These guides cover them.
Quickstart
From nothing to a signed record in four steps: request access, instrument, run, verify.
The collector
Auto-instrumentation for Node agents: configuration, session strategies, what is and is not captured, usage policies and content commitments.
Verifying records
Check a record is genuine without trusting AER: browser, CLI and library verification, pinned keys and offline transparency-anchor proof.
Admission control
Only admit agents that carry a live AER attestation: protect an MCP server or any HTTP resource, scopes, revocation and the deny contract.
The SDK
Record from your own code: batching and retry semantics, what to emit, severity hints and sessions from scratch.
Operating AER
Webhooks and digests, retention and visibility, share links for auditors, exports and the tamper-evident audit chain.
Content commitments
Prove a prompt or response byte-exact without AER ever seeing it: customer-held keys, one-way tags, offline opening.
API reference
The public HTTP API: sessions, event ingest, completion, verification and exports.
The shape of the system
An agent runs with the collector attached. The collector captures metadata about what the agent does (LLM calls, tool calls, HTTP requests, processes, files) and streams it to the AER API as events. When the session completes, AER canonicalises the events into a bundle, hashes it with SHA-256, signs the hash with Ed25519 and anchors the signature to the public Sigstore Rekor transparency log. Anyone can verify the result offline.
The capture is bodies-off by design: model names, token counts, tool names, hosts and paths are recorded; prompts, completions, tool arguments, request bodies and headers never are. This boundary is enforced twice, first in the collector and again server side at ingest, where unrecognised payload keys are stripped before storage.
What is open and what is not
Every package that runs in your infrastructure is public on npm under @adastracomputing: the collector (aer-auto-node), the SDK (aer-sdk-ts), the CLI (aer), the verifier (aer-verify), the resource-side token check (aer-resource-node) and the MCP guard (aer-mcp-guard). The AER service itself is not open source; you never have to trust it, because verification works against pinned keys you obtain out of band.