u/Funky_Chicken_22

Etch is now available as an MCP server. Every event your agent writes gets signed and Merkle-chained into a local per-project tamper-evident log. Epochs anchor to Sigstore Rekor and OTS for independent third-party verification.

Try without signing up:

curl -X POST https://etch.systems/v1/your-project

Response gives a bearer token and an MCP endpoint URL. Point any MCP-compliant client (Claude Code, Cursor, Continue, Cline, Codex) at https://etch.systems/mcp with the token. 500 events, 14 days retention. Convert to a persistent project any time to keep the chain.

Listed at:

• Official MCP Registry: io.github.SaravananJaichandar/etch
• Glama: search "etch" on glama.ai

Not memory. Not a log. Signed evidence, added the same way you add any other MCP tool. Feedback welcome, especially on scope heuristics for what to sign per-event vs sample.

Repo: https://github.com/SaravananJaichandar/etch-mcp

With MCP becoming the default surface for AI agents, "how do we prove what an agent decided" has a cleaner integration path than it did six months ago. If the agent already speaks MCP, adding signed evidence is just another tool call, not a separate wiring project.

Two design choices seem to matter for enterprise adoption:

1. Where the signing happens : local per-project chain vs centralized log
2. Scope : sign every decision, or sample by policy impact

Etch (etch.systems) is one implementation of the pattern: per-project SQLite chain, hybrid signing, epochs anchored to Sigstore and OTS. Reference verifier walks the chain offline against pinned public keys.

Try the shape: curl -X POST https://etch.systems/v1/your-project returns a token, point any MCP client at etch.systems/mcp. Framework mapping to SR 11-7, EU AI Act Article 12, ISO 42001, NIST AI RMF at etch.systems/aarm.

Interested in what the audit-side asks in your context. What's the framework-mapping bottleneck that keeps signed-evidence pilots from converting to production?

Most "**AI agent audit**" conversations stall on the same thing. Everyone says their agents are auditable, nobody can say auditable to what standard. "**We have logs**" gets treated as an answer, but a log you fully control is a log you could have edited. For a while there was no shared bar, so every tool graded its own homework.

That gap started to close recently. The Cloud Security Alliance published a conformance model called **AARM** (Autonomous Action Runtime Management, by Herman Errico, arXiv 2602.09433, CC BY 4.0). I did not write it. It just writes down what "**auditable**" should mean for an autonomous agent, as two lists.

Nine properties an audit primitive should have:

1. Tamper-evident receipt for every action
2. Cryptographic identity binding (a record is tied to who or what produced it)
3. External anchor (a third party can verify against something outside your own system)
4. Third-party offline verification (someone who does not trust you and cannot touch your servers can still check it)
5. Cross-agent handoff (the chain survives when a decision passes between agents)
6. Retrospective governance revision (correct or supersede a past decision without secretly rewriting history)
7. Runtime authorization decisions
8. Least-privilege posture
9. Session-scoped disclosure (an auditor sees one session, not your whole ledger)

Ten threats it should hold up against: memory poisoning, goal hijacking, intent drift, context accumulation, confused deputy, cross-agent propagation, data exfiltration, malicious tool output, environmental manipulation, over-privileged credentials.

What I actually did: I built a tool ([Etch](https://etch.systems/), an MCP-based signing and notary primitive) and mapped it against AARM in public, including two properties where it flat out does not conform. Runtime authorization and least-privilege are marked out of scope, because they belong to an enforcement layer and I deliberately kept the tool out of the execution path. My reasoning: a product that both enforces policy and writes the only record of whether it enforced policy correctly is its own unaudited author. Separating evidence from enforcement is what makes the evidence worth anything. But I am not certain that is the right call and I want to hear the counterargument.

So, genuinely:

* Is AARM's 9-property split the right cut, or is something missing or redundant? * Is "**evidence layer, not enforcement layer**" a cop-out or the correct boundary? * If you run agents in production, what bar does your audit layer actually meet? If none you can name, does that bother you or not?

AARM spec: aarm.dev/spec My conformance statement (pass and fail per property): etch.systems/aarm

Happy to be told I got it wrong.

Most "AI agent audit" conversations stall on the same thing. Everyone says their agents are auditable, nobody can say auditable to what standard. "We have logs" gets treated as an answer, but a log you fully control is a log you could have edited. For a while there was no shared bar, so every tool graded its own homework.

That gap started to close recently. The Cloud Security Alliance published a conformance model called AARM (Autonomous Action Runtime Management, by Herman Errico, arXiv 2602.09433, CC BY 4.0). I did not write it. It just writes down what "auditable" should mean for an autonomous agent, as two lists.

Nine properties an audit primitive should have:

1. Tamper-evident receipt for every action
2. Cryptographic identity binding (a record is tied to who or what produced it)
3. External anchor (a third party can verify against something outside your own system)
4. Third-party offline verification (someone who does not trust you and cannot touch your servers can still check it)
5. Cross-agent handoff (the chain survives when a decision passes between agents)
6. Retrospective governance revision (correct or supersede a past decision without secretly rewriting history)
7. Runtime authorization decisions
8. Least-privilege posture
9. Session-scoped disclosure (an auditor sees one session, not your whole ledger)

Ten threats it should hold up against: memory poisoning, goal hijacking, intent drift, context accumulation, confused deputy, cross-agent propagation, data exfiltration, malicious tool output, environmental manipulation, over-privileged credentials.

What I actually did: I built a tool (Etch, an MCP-based signing and notary primitive) and mapped it against AARM in public, including two properties where it flat out does not conform. Runtime authorization and least-privilege are marked out of scope, because they belong to an enforcement layer and I deliberately kept the tool out of the execution path. My reasoning: a product that both enforces policy and writes the only record of whether it enforced policy correctly is its own unaudited author. Separating evidence from enforcement is what makes the evidence worth anything. But I am not certain that is the right call and I want to hear the counterargument.

So, genuinely:

• Is AARM's 9-property split the right cut, or is something missing or redundant?
• Is "evidence layer, not enforcement layer" a cop-out or the correct boundary?
• If you run agents in production, what bar does your audit layer actually meet? If none you can name, does that bother you or not?

AARM spec: aarm.dev/spec My conformance statement (pass and fail per property): etch.systems/aarm

Happy to be told I got it wrong.

Most "AI agent audit" conversations stall on the same thing. Everyone says their agents are auditable, nobody can say auditable to what standard. "We have logs" gets treated as an answer, but a log you fully control is a log you could have edited. For a while there was no shared bar, so every tool graded its own homework.

That gap started to close recently. The Cloud Security Alliance published a conformance model called AARM (Autonomous Action Runtime Management, by Herman Errico, arXiv 2602.09433, CC BY 4.0). I did not write it. It just writes down what "auditable" should mean for an autonomous agent, as two lists.

Nine properties an audit primitive should have:

1. Tamper-evident receipt for every action
2. Cryptographic identity binding (a record is tied to who or what produced it)
3. External anchor (a third party can verify against something outside your own system)
4. Third-party offline verification (someone who does not trust you and cannot touch your servers can still check it)
5. Cross-agent handoff (the chain survives when a decision passes between agents)
6. Retrospective governance revision (correct or supersede a past decision without secretly rewriting history)
7. Runtime authorization decisions
8. Least-privilege posture
9. Session-scoped disclosure (an auditor sees one session, not your whole ledger)

Ten threats it should hold up against: memory poisoning, goal hijacking, intent drift, context accumulation, confused deputy, cross-agent propagation, data exfiltration, malicious tool output, environmental manipulation, over-privileged credentials.

What I actually did: I built a tool (Etch, an MCP-based signing and notary primitive) and mapped it against AARM in public, including two properties where it flat out does not conform. Runtime authorization and least-privilege are marked out of scope, because they belong to an enforcement layer and I deliberately kept the tool out of the execution path. My reasoning: a product that both enforces policy and writes the only record of whether it enforced policy correctly is its own unaudited author. Separating evidence from enforcement is what makes the evidence worth anything. But I am not certain that is the right call and I want to hear the counterargument.

So, genuinely:

• Is AARM's 9-property split the right cut, or is something missing or redundant?
• Is "evidence layer, not enforcement layer" a cop-out or the correct boundary?
• If you run agents in production, what bar does your audit layer actually meet? If none you can name, does that bother you or not?

AARM spec: aarm.dev/spec My conformance statement (pass and fail per property): etch.systems/aarm

Happy to be told I got it wrong.

Ex-Chief Data Scientist and co-founder, 10+ years building software and ML. I can take a product from zero to one, and I am looking to do that as a technical co-founder for someone with a real wedge. Remote, equity-based.

**Who I am**

* Six years as co-founder and Chief Data Scientist at a venture-backed analytics company (backed by Coinbase Ventures, Animoca Brands, and Polygon; 10.6M dollars raised). I built the data and ML function from zero into the core product. * I architected a fraud and anomaly-detection system that surfaced over 169M dollars in fraudulent activity. It became the flagship offering. * Before that I ran my own software studio, shipping mobile and web products for paying clients.

**What I bring**

* End-to-end product build: ML and data science, AI agents, backend, data engineering, and enough front-end to ship a real product without waiting on anyone. * Fraud and anomaly detection, computer vision, pricing and recommendation models, RAG and agentic systems, and the eval and guardrails discipline that makes an AI product actually trustworthy. * Founder muscle: hiring, investor diligence, customer conversations, and shipping under real constraints.

**What I am looking for**

* A founder or small team with a genuine wedge, a specific painful problem, early traction, or deep domain access, ideally in AI, data, fintech, or insurtech, though I am open to a strong case anywhere. * A technical co-founder seat with meaningful equity. Currently I am based in India and work remotely. * Someone serious. I am most useful to people who already have signal (customers, a design partner, or domain access), not only an idea on a slide.

If this sounds like a fit, send me a DM with what you are building and what you have so far. Happy to get on a call.

Ex-Chief Data Scientist and co-founder, 10+ years building software and ML. I can take a product from zero to one, and I am looking to do that as a technical co-founder for someone with a real wedge. Remote, equity-based.

**Who I am**

* Six years as co-founder and Chief Data Scientist at a venture-backed analytics company (backed by Coinbase Ventures, Animoca Brands, and Polygon; 10.6M dollars raised). I built the data and ML function from zero into the core product. * I architected a fraud and anomaly-detection system that surfaced over 169M dollars in fraudulent activity. It became the flagship offering. * Before that I ran my own software studio, shipping mobile and web products for paying clients.

**What I bring**

* End-to-end product build: ML and data science, AI agents, backend, data engineering, and enough front-end to ship a real product without waiting on anyone. * Fraud and anomaly detection, computer vision, pricing and recommendation models, RAG and agentic systems, and the eval and guardrails discipline that makes an AI product actually trustworthy. * Founder muscle: hiring, investor diligence, customer conversations, and shipping under real constraints.

**What I am looking for**

* A founder or small team with a genuine wedge, a specific painful problem, early traction, or deep domain access, ideally in AI, data, fintech, or insurtech, though I am open to a strong case anywhere. * A technical co-founder seat with meaningful equity. Currently I am based in India and work remotely. * Someone serious. I am most useful to people who already have signal (customers, a design partner, or domain access), not only an idea on a slide.

If this sounds like a fit, send me a DM with what you are building and what you have so far. Happy to get on a call.

Something I keep hitting when running multi-agent workflows: subagent replies bleed across sessions, an agent handoff drops context on the floor, or the top-level task takes a hard turn and I cannot tell which subagent decision caused it. By the time I go to debug, the in-memory transcript is gone and the text logs cannot answer basic causality questions.

I have been building an event layer that sits underneath the agent runtime and records every decision (anchor prompt, tool call, tool input, tool output, downstream events, cross-session references) into a signed append-only chain. It answers three questions text logs cannot:

1. Which prior decision led to this file being edited? (Prior tool calls in same session, filtered to exclude user prompts)

2. Which session actually received the subagent reply? (Cross-session bleed detection)

3. What context did the agent hold at the exact moment it ran this tool? (Reasoning trace, prior N events, anchor prompt)

Each event is signed with hybrid signature, so the record survives a decade of retention and stays verifiable if the runtime rewrites history. Runs on top of any agent that speaks MCP or emits webhook events.

Two weeks of prod use, 156k events across a canary customer, first paid pilot conversation in progress with a regulated-industry buyer.

1. What is the FIRST question you want answered when a multi-agent run goes wrong? "Which agent did what" or "what did the shared state look like at time T" or something else?

2. For those using MCP, would you want provenance capture as a runtime layer, or as a first class part of the MCP spec?

Link to the product and the OSS memory MCP that feeds it are in the comments.

Six months ago I started world-model-mcp to give coding agents a temporal knowledge graph for better enforcement and fewer repeated mistakes. It improved things on the memory and constraint side. But after using it in real projects, I realised the bigger missing piece was verifiable decision history.

Even when the agent made good decisions, there was no independent way to prove later what context it used or what rules it followed. That led to building Etch on top, a layer that puts every tool call into a signed Merkle chain with hybrid post-quantum signatures. The full history can be verified offline without needing the vendor. We now have both the enforcement layer and the cryptographic audit layer.

We have signed over 163k events so far. I’m still figuring out why adoption is slow. Most agent users seem to feel the memory/context pain strongly, but verifiable audit trails don’t feel urgent until they hit a review or compliance situation.

Has anyone else experienced this gap with agent memory and auditability? Would love to hear how others are thinking about it.

Ex-Chief Data Scientist and co-founder, 10+ years building software and ML. I can take a product from zero to one, and I am looking to do that as a technical co-founder for someone with a real wedge. Remote, equity-based.

Who I am

• Six years as co-founder and Chief Data Scientist at a venture-backed analytics company (backed by Coinbase Ventures, Animoca Brands, and Polygon; 10.6M dollars raised). I built the data and ML function from zero into the core product.
• I architected a fraud and anomaly-detection system that surfaced over 169M dollars in fraudulent activity. It became the flagship offering.
• Before that I ran my own software studio, shipping mobile and web products for paying clients.

What I bring

• End-to-end product build: ML and data science, AI agents, backend, data engineering, and enough front-end to ship a real product without waiting on anyone.
• Fraud and anomaly detection, computer vision, pricing and recommendation models, RAG and agentic systems, and the eval and guardrails discipline that makes an AI product actually trustworthy.
• Founder muscle: hiring, investor diligence, customer conversations, and shipping under real constraints.

What I am looking for

• A founder or small team with a genuine wedge, a specific painful problem, early traction, or deep domain access, ideally in AI, data, fintech, or insurtech, though I am open to a strong case anywhere.
• A technical co-founder seat with meaningful equity. Currently I am based in India and work remotely.
• Someone serious. I am most useful to people who already have signal (customers, a design partner, or domain access), not only an idea on a slide.

If this sounds like a fit, send me a DM with what you are building and what you have so far. Happy to get on a call.

Been thinking about the post quantum migration for a while and built a small tool that scores exposure risk for any Ethereum address.

How it works: every ECDSA signed transaction reveals the signer's public key on chain. Once you have sent one transaction from an address, that public key is on chain permanently. If a sufficiently capable quantum computer arrives, it can derive the private key from that public key using Shor's algorithm.

The tool takes any EVM address or ENS name and returns:

- Whether the public key is already on chain (exposed)

- The value at risk

- How long the exposure has existed

- A 0 to 100 exposure score

Read only. No wallet connection. No signup.

claak.io/scan

Vitalik.eth is prefilled as a demo.

The scanner is free and standalone. Full disclosure: I contribute to Claak, but this post is about the scanner as an open piece of crypto tooling for the community. Google's March paper cut the qubit threshold to roughly 1,152 logical qubits. Eigen Labs' open ecdsa.fail benchmark is past Google. NSA has set 2030 as the migration deadline.

Happy to walk through methodology if anyone is curious. What score

did you get on your main address?

Claak is a self custody wallet currently in pre-alpha. We are building it because the cryptographic math behind every wallet in use today does not survive a sufficiently large quantum computer. NIST has finalised the replacement signature schemes. The U.S. government has set 2030 as the migration deadline.

Why this matters for DeFi specifically: every wallet that interacts with a DeFi protocol today signs with key math that will eventually break. When the migration happens, every user holding positions in lending markets, AMMs, perps, and yield protocols will need to move to new keys. Claak is designed to make that transition possible without losing your existing protocol positions or interaction history.

The wallet runs on Solana, Ethereum, and Bitcoin. It is post quantum from the first key, not retrofitted. Mainstream safety features include spend limits, recipient allow lists, and withdrawal time locks. It works with existing DeFi apps.

Risks and current state:

- Pre alpha software. May contain bugs.

- Not yet third party audited. External cryptographic review is being arranged for the production release. Until then, this protocol should not be considered production ready.

- Post quantum signatures are larger than current ones. Transaction costs on some chains will be slightly higher than legacy wallets.

Open questions for the DeFi community:

1. Which DeFi protocols would you most want a post quantum wallet to integrate with first?

2. What migration concerns do you have for your own existing positions when the chain level migration happens?

3. How do you want a wallet to handle the transition window where some addresses are post quantum and others are still legacy?

Looking for feedback on these and other migration questions from the community. Not posting links per sub rules. Will discuss specifics in comments if any of this is useful to discuss.

Every wallet on Solana today signs transactions with key math that quantum computers eventually break. Same story on every other chain. NIST has finalised the replacements. The U.S. government has set 2030 as the migration deadline.

Most of the wallet ecosystem is going to have to migrate. We have been building Claak (Claak.io), so that the migration does not have to mean throwing away your wallet, your apps, or your habits.

Claak is post quantum from the first key. It runs on Solana, Ethereum, and Bitcoin. It comes with the safety features most people actually want: spend limits, recipient allow lists, withdrawal time locks. It works with the apps you already use.

We are opening 50 slots for the first round of alpha testing. Looking for testers who will move real funds and report what breaks.

Happy to answer questions in the comments and also the access form link.