Verify agent requests, apply policy, return portable signed records
Start with middleware or the MCP server. Keep the rest of your stack.
Logs stay local. Signed records travel.
POST /api/bookings
Authorization: Bearer <agent-token>
// Originary evaluates
-> agent identity: verified
-> policy matched: bookings.default
-> decision: allow
// Signed record returned
PEAC-Receipt: eyJhbGciOiJFZERTQ...
// Ed25519 · portable · offline-verifiable28 packages · 6,443 tests · Apache-2.0 · v0.12.3
Built for operators, not just builders
Originary is built first for teams running the systems that agents access. If your stack receives agent requests, Originary gives you the verification layer.
APIs receiving agent traffic
Evaluate incoming agent requests, apply rate and access policy, return signed records of every decision.
MCP servers and tool hosts
Add verification middleware to any tool endpoint. Signed records travel with the response.
Platforms exposing actions to agents
Policy sits at the boundary. Records prove what was allowed, denied, or challenged.
Security and compliance teams
Exportable, portable records for audit, disputes, and procurement review. Offline-verifiable.
Works with your existing gateway, auth, payments, and observability stack.
How it works
Evaluate the request
Classify inbound agent requests before action is taken.
Apply policy
Allow, deny, review, rate-limit, require approval, or charge based on your rules.
Emit the record
Create a portable signed record your team can inspect, verify, and export later.
Request lifecycle
Evaluate
Classify inbound request using available signals
Apply policy
Your rules determine the access decision
Emit record
Signed record returned and exportable
Evaluate
Classify inbound request using available signals
Apply policy
Your rules determine the access decision
Emit record
Signed record returned and exportable
Works with the signals you have today. More signals produce stronger decisions and more complete records.
Built for verification, not vendor dependency
Self-hostable
Run verification on your own infrastructure. No external service dependency.
Offline verification
Verify any record using the public key alone. No API calls, no network required.
Exportable records
Portable signed records your team can inspect, share, archive, and use in disputes.
Open standard, no lock-in
Built on PEAC Protocol (Apache-2.0). Records are portable across systems and vendors.
Why logs are not enough
Logs and traces help with debugging. They do not replace explicit policy decisions or exportable records.
Originary adds:
- Evaluate requests before action is taken
- Apply explicit policy decisions
- Keep exportable records for review and disputes
Debug system behavior
Make access decisions
Keep an exportable record
Support cross-team review
Open standard underneath
| Need | Logs / traces | Originary |
|---|---|---|
| Debug system behavior | Yes | Partial |
| Make access decisions | Limited | Yes |
| Keep an exportable record | No | Yes |
| Support cross-team review | Weak | Yes |
| Open standard underneath | No | Yes |
Use the product now. Keep the record portable.
Originary is the product. PEAC keeps the record portable across systems and vendors.
Ed25519 signatures, JWS compact serialization
28 packages on npm, 6,443 tests
Offline-verifiable with public key alone
Apache-2.0, self-hostable, vendor-neutral
Frequently asked questions
See how a request becomes a signed record
Open a real signed record, inspect the claims, and verify the signature. No account required.