For APIs, tools, and MCP servers

Prove what
agents did

Originary verifies requests, applies policy, and returns signed records you can prove later, across teams, vendors, and audits.

Open source·Self-hostable·Offline verification·Portable·Downloads
Signed interaction recordVerified locally
ISSUERtools.vendor.com
TYPEorg.peacprotocol/access
POLICYsha256:3f8a...c7e1
SIGNEDEd25519 valid
VERIFYlocal, no callback
No Originary dependency in verificationInspect →

Sample record. Verified with issuer public key only.

The real question

Who called. What happened. Where's the proof?

Most systems can tell you what they observed. Fewer can prove what policy applied, what decision was made, and what record exists afterward. Originary makes that decision boundary explicit.

When an agent hits your API, tool, or MCP server, three things matter:

Who sent the request
What policy applied
What record exists afterward

Originary gives you that record without asking you to replace the rest of your stack.

Logs vs. decisions

Logs explain behavior. Records prove decisions.

Logs are useful for debugging inside your systems. They are weak evidence outside them. Originary returns signed records another party can inspect and verify independently.

Signed recordPortable proof
Issuer: tools.vendor.com
Type: org.peacprotocol/access
Policy: sha256:3f8a...c7e1 ✓
Signature: Ed25519, valid
Verify: local, no callback
Verifiable by any party, offline.
Internal logsLocal only
14:23:01Agent invoked tool: check_inventory
14:23:01External API call: GET /api/v2/inventory
14:23:02Policy: tools.check_inventory → allow
14:23:02Result returned to agent
Useful for debugging. Not portable.

Debug system behavior

LogsYes
OriginaryPartial

Make access decisions

LogsLimited
OriginaryYes

Keep an exportable record

LogsNo
OriginaryYes

Support cross-team review

LogsWeak
OriginaryYes

Open standard underneath

LogsNo
OriginaryYes

Originary adds:

Evaluate requests before action is takenApply explicit policy decisionsKeep exportable records for review and disputes
Who this is for

Built for the systems agents touch

Originary is for teams operating APIs, tools, gateways, MCP servers, and review workflows. If your systems receive automated requests, you need evidence that survives beyond your own dashboards.

API operators

An agent books a resource through your API

You need to know who authorized it, under what policy, and prove the decision later when the charge is disputed.

MCP server hosts

An MCP tool call modifies production data

The tool host needs a signed record of what was requested, what was allowed, and what the agent actually did.

Platform teams

A partner asks for proof of an agent interaction

You export a portable record they can verify independently, offline, without calling your systems.

Security and compliance

An auditor reviews agent-driven transactions

Compliance needs exportable evidence tied to the policy that applied at decision time, not just logs.

Works with your existing gateway, auth, payments, and observability stack.

Why trust Originary

Built to be verified without us

Every record should survive vendor boundaries. Originary can issue and manage records in production, but verification should remain local, portable, and independent.

01

Self-hostable

Run on your own infrastructure. No external dependency.

02

Offline verification

Verify with the public key alone. No network required.

03

Exportable records

Inspect, share, archive, and use in disputes.

04

Open standard

PEAC Protocol, Apache-2.0. Portable across vendors.

05

Ed25519 signatures

Every record is signed with Ed25519 and independently verifiable.

06

Audit and dispute ready

Timestamped evidence for compliance and procurement.

Why this matters now

Evidence is not keeping up with automation

01

Agents are crossing boundaries

APIs, tools, and MCP servers handle agent traffic from organizations they do not control. Standard proof is missing.

02

Compliance is catching up

Compliance and review expectations for automated decisions are rising. Auditable records will be expected.

03

Logs are not enough

Internal observability helps you debug. It does not help a partner, auditor, or regulator verify what happened.

Open standard

Deploy Originary. Keep your records portable.

Originary is the product you deploy. PEAC is the open standard that keeps your records portable across systems and vendors. No lock-in.

Ed25519 signatures, verified offline with a public key

29 packages on npm, 6,664 tests

Offline-verifiable with public key alone

Apache-2.0, self-hostable, vendor-neutral

FAQ

Frequently asked questions

A verifiable interaction record is a portable, cryptographically signed artifact that proves what an agent did, what policy applied, and what decision was made. It can be verified by anyone with the public key, with no network call required.

Developers

Open a signed record or start issuing one

Teams

Planning a deployment or procurement review?