swarrm
A flight recorder for AI agents

Capture what your AI did.
Verify the record.

Your agents take real actions on their own — approve refunds, move money, make calls for your customers. Swarrm gives each captured action a signed receipt in a tamper-evident log. If a decision is questioned, you hold a self-contained E1 bundle whose integrity anyone can check offline, without an account.

Verify a bundle → See how it works
The problem

“Our logs say so” isn’t proof.

Editable logs ask a later reviewer to trust whoever controlled them. A signed, checkpointed log gives that reviewer integrity checks they can rerun.

Your logs can be edited

Whoever controls a conventional database may be able to rewrite it. That weakens the record precisely when its history matters.

The AI vendor can’t vouch for itself

A platform grading its own AI’s homework is not enough. A separate verifier can test signatures and log structure without calling the producer.

Integrity checks have to survive the wait

Incidents and reviews show up months later. A self-contained bundle keeps the base integrity checks available to someone who was not there.

How it actually works

Four steps. No black box in the black box.

Plain enough to follow, real enough to hand your engineer or your auditor. The technical name for each step is on the right.

1
Sign each captured action
Each action the recorder captures becomes a canonical DSSE receipt signed with the recorder key.
signature: Ed25519, DSSE envelope, at capture time
2
Link it into a checkpointed log
Each signed receipt is included in an RFC 6962 Merkle log. Altering the presented receipt or its authenticated log path makes base verification fail.
structure: Merkle transparency log (RFC 6962); inclusion + consistency proofs
3
Label external claims honestly
The bundle may carry a Base Sepolia anchor transaction and a non-qualified RFC 3161 timestamp. Today the offline verifier checks their binding to the checkpoint, but not the chain or an independently supplied TSA trust root.
claims: Base Sepolia staging + non-qualified RFC 3161; no offline E2 award
4
Verify base E1 integrity offline
Whoever holds the bundle can check receipt signatures, key history, Merkle inclusion and consistency, and the checkpoint chain with an open-source verifier. That is technical integrity, not an audit or legal conclusion.
verifier: open-source, client-side (Rust→WASM); runs with no network

Recording is designed to stay outside the agent's critical path, and the gateway supports fail-open operation. Swarrm is Beta: validate capture, persistence, and failure behaviour in your own setup before relying on it.

Don’t take our word for E1 integrity.

Drop a real bundle into your browser and check its signed receipts and log structure offline. Then change one character and watch base verification fail. Anchor and timestamp fields remain labelled claims.

Verify a bundle →

Start free, on your own machine.

No account, no cloud bill, no sales call. Install it, run the demo, and inspect an E1-verified record locally.

Get started →

Executive briefing

A one-page summary: what Swarrm proves today, what is withdrawn, and what higher assurance still requires.

Download (PDF)
Straight answers

The questions everyone asks.

What is this, in one sentence?
A Beta flight recorder for AI agents: it puts signed receipts for captured actions into a tamper-evident log and exports a self-contained bundle whose base E1 integrity anyone can verify offline.
Will it slow down or break my AI?
The recorder is designed to run out of path and the gateway supports fail-open operation, so a capture failure need not block the agent call. Swarrm has no paid production deployment yet; test the exact failure behaviour and evidence gaps in your configuration.
Do you see my data?
The evidence log stores fingerprints and operational metadata, not prompts, outputs, tool arguments, or customer payloads. The hosted gateway relays payloads in transit and is designed not to persist them. Self-hosting keeps payloads inside your network; you control whether hashes and metadata egress.
What happens if we get hacked?
If an attacker changes a presented receipt or its authenticated log path, E1 verification detects the mismatch. Swarrm cannot prove that an uncaptured or lost action occurred, independently identify the actor, or make a forensic, legal, or insurance determination.
Who can verify a record?
Anyone you share the bundle with. The verifier is open-source and runs in a plain browser — no account or API access. Python and Rust implementations are checked against the same adversarial E1 fixtures.
Is this blockchain?
There is no token or proprietary chain. A bundle may include a Base Sepolia staging transaction and a non-qualified timestamp, but the offline verifier currently treats both as claims: it checks their binding to the checkpoint, not the chain or an independent TSA trust root. E1 verifies without them.
What does it cost?
Running it yourself and verifying bundles are free. The hosted service is a Beta trial with no SLA; no paid production deployment has been completed.