Quickstart

Get started with AER

Four steps take you from nothing to a signed record of what your agent did. The collector watches tool calls, HTTP requests and LLM turns, and AER signs the whole trace when the session ends.

Request access

Tell us about the agent you want to record. We provision a tenant, an agent and an API key and send them back over a secure channel.

Request access

Instrument

One command wires the auto-instrumentation collector into your Node project (Node 22 or newer). It needs four values: your tenant, your agent and your key, all issued to you, plus an environment id you choose yourself.

npx @adastracomputing/aer init
export AER_API_KEY=...
export AER_ENV_ID=$(uuidgen | tr 'A-Z' 'a-z')

nix run github:Ad-Astra-Computing/aer#aer -- init
export AER_API_KEY=...
export AER_ENV_ID=$(uuidgen | tr 'A-Z' 'a-z')

Generate the environment id once and keep it. It groups everything that runs in one place, so a new one starts a new environment with no history. What each value is.

To run an instrumented agent with no npm at all, nix build github:Ad-Astra-Computing/aer#node-modules and link the result in as node_modules.

Run

Start your agent with the collector preloaded. Events stream to the console live while the agent runs.

node --import @adastracomputing/aer-auto-node/register your-agent.js

Verify

When the session completes AER signs the record. Anyone can check the signature, no key required.

npx @adastracomputing/aer verify <aer-id>

nix run github:Ad-Astra-Computing/aer#aer -- verify <aer-id>

See a real record

Beyond recording

Protect an MCP resource

The steps above record what an agent did. AER can also gate what an agent is allowed to reach. A running session mints a short-lived attestation token, and a protected MCP server admits only requests that carry a valid, non-revoked one. A rogue agent that does not run the collector has no token and is denied. AER stays out of the request path: the resource verifies offline against the published JWKS.

Resource side (Hono shown)

import { honoMcpGuard } from '@adastracomputing/aer-mcp-guard/hono';
app.use('/mcp/*', honoMcpGuard({ audience: 'mcp://payments-prod' }));

The agent side is zero code: name the host in the collector config and it attaches the attestation automatically. Your resource server checks tokens with a verifier key, which your tenant mints itself (POST /v1/verifier-keys, see the API reference) — no operator involved.

Full guides and the API reference are available once you have access.

Request access API reference