Trust Layer

ArkForge Trust Layer

Cryptographic proof of what your agent executed. Every API call through ArkForge produces an immutable, signed, timestamped receipt — verifiable by anyone, forever.

Not a log. Not a trace. A proof.

# One curl. Instant. No card required.
curl -X POST https://trust.arkforge.tech/v1/keys/free-signup \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}'
# → {"api_key": "mcp_free_xxxx...", "plan": "free", "limit": "500 proofs/month"}

[](https://trust.arkforge.tech/v1/health) [](https://arkforge.tech/en/pro-signup.html?utmsource=github&utmmedium=readme&utmcampaign=trustlayer) [](https://github.com/ark-forge/proof-spec) [](LICENSE)

---

Why ArkForge

When an agent calls an API, pays a provider, or executes a task on your behalf — what proof do you have?

Internal logs are mutable. Your agent can rewrite them. Your provider can deny delivery. In regulated environments (AI Act, DORA, NIS2), "the system said so" is not evidence.

ArkForge certifies the exact request sent, the exact response received, the payment made, and the exact moment it happened — bound in a cryptographic chain hash, signed with Ed25519, timestamped via RFC 3161, and anchored in Sigstore Rekor. No field can be altered after the fact without breaking the proof.

Why not just use CloudTrail / a SIEM?

Cloud audit logs (CloudTrail, Azure Monitor, etc.) are controlled by the same party that generated the event. They prove nothing to a third party. A SIEM aggregates your own logs — it doesn't produce independent evidence.

ArkForge is a neutral proxy: it sits between your agent and any upstream API, records the exchange from the outside, signs it with its own key, and registers it in a public append-only log. Neither party controls the proof.

---

How it works

Agent  →  POST /v1/proxy  →  ArkForge  →  Upstream API
                                ↓
                     SHA-256 chain hash
                     Ed25519 signature
                     RFC 3161 timestamp
                     Sigstore Rekor anchor
                                ↓
                     Immutable proof JSON + public HTML page

One call, three independent witnesses:

| Witness | What it proves | Verifiable by | |---------|---------------|---------------| | Ed25519 Signature | Proof was issued by ArkForge | Anyone with the public key | | RFC 3161 Timestamp | Proof existed at the claimed time | Any RFC 3161 verifier | | Sigstore Rekor | Chain hash in a public append-only log | search.sigstore.dev |

See a live proof: example transaction

---

Get started in 60 seconds

Step 1 — Free API key (no card)

curl -X POST https://trust.arkforge.tech/v1/keys/free-signup \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}'
# → {"api_key": "mcp_free_xxxx...", "plan": "free", "limit": "500 proofs/month"}

Step 2 — Make a certified API call

curl -X POST https://trust.arkforge.tech/v1/proxy \
  -H "X-Api-Key: mcp_free_xxxx..." \
  -H "Content-Type: application/json" \
  -d '{
    "target": "https://api.example.com/v1/run",
    "payload": {"task": "analyze", "text": "hello"}
  }'

ArkForge forwards your request, fingerprints the exchange (SHA-256), signs it (Ed25519), and returns the result with a proof.

Step 3 — Verify

curl https://trust.arkforge.tech/v1/proof/prf_20260227_110211_a27069

Or open it in a browser — every proof has a public HTML verification page with a color-coded badge.

---

Use cases

Machine payments (MPP / x402 / agentic billing)

Protocols like Stripe MPP, x402, and ACP let agents pay autonomously for services. ArkForge adds the missing layer: who authorized the payment, and how to prove it.

When an agent charges a card or transfers stablecoins autonomously, "the agent did it" is not a compliance answer. PSD2, AML, and the EU AI Act require a verifiable authorization chain — which agent version, which prompt was active, which principal approved the spend. ArkForge certifies that chain at the moment of execution, before the payment settles.

Agent → authorize payment decision → ArkForge certifies (agent version + prompt hash + decision)
                                          ↓
                              Stripe MPP / x402 / ACP → provider
                                          ↓
                              Proof: authorization + payment receipt + timestamp (tamper-proof)

Agent paying a provider

An autonomous agent calls a third-party API and pays for the service. ArkForge certifies the transaction: the exact request, the exact response, the payment evidence, and the timestamp — all bound in one cryptographic proof. The provider cannot deny delivery. The agent cannot deny the request.

Agent → POST /v1/proxy (with payment receipt URL) → ArkForge → Provider API
                                                          ↓
                                             Proof: request + response + receipt hash + timestamp

MCP tool call certification

Model Context Protocol (MCP) is becoming the standard for connecting AI agents to tools and external services. Every tools/call is a real-world action — but MCP has no built-in auditability. ArkForge fills that gap.

Route your MCP server's outbound calls through the Trust Layer proxy. Each tool call produces a signed, timestamped receipt — an Agent Action Receipt (AAR) — independently verifiable by your client, your auditor, or a regulator.

Claude / agent
     │ tools/call
     ▼
MCP Server  →  POST /v1/proxy  →  ArkForge  →  External API / service
                                      ↓
                         AAR: tool_name + args + result
                              + Ed25519 signature
                              + RFC 3161 timestamp
                              + Sigstore Rekor anchor

What this gives you:

• Proof that tool X was called with args Y and returned Z — not just a log entry
• Non-repudiation: the MCP server cannot later deny a call, the downstream service cannot deny delivery
• Portable receipts your client can verify without trusting your infrastructure

One env var, zero SDK change:

# Before: MCP server calls external APIs directly
EXTERNAL_API_URL=https://api.example.com

# After: route through Trust Layer
EXTERNAL_API_URL=https://trust.arkforge.tech/v1/proxy
ARKFORGE_API_KEY=mcp_pro_xxx...
ARKFORGE_TARGET=https://api.example.com

Directly relevant to: OWASP Top 10 for Agentic Applications 2026 (signed audit logs per tool call), EU AI Act Article 12 (logging for high-risk AI), DORA Article 11.

Human auditing an agent

A team deploys an agent in production. The agent routes its LLM and API calls through ArkForge. The team gets a verifiable audit trail: which model, which exact prompt, what response, at what time, at what cost. Unlike internal logs, these proofs are signed and anchored — they cannot be altered after the fact.

Human client hires agent → agent routes all calls through ArkForge
                                         ↓
                            Immutable audit trail: model + prompt + response + timestamp + cost
                                         ↓
                            Human verifies: "here is exactly what my agent did"

Directly relevant to: DORA (Article 11 — ICT incident management), NIS2 (Article 21 — traceability), EU AI Act (Article 12 — logging obligations for high-risk AI systems).

---

Features

Core

• Execution certification — every API call produces a cryptographic proof of what was sent, received, and when. Immutable after creation.
• Chain hash — SHA-256 binding of request, response, payment, timestamp, buyer, and seller. Public formula, independently recomputable.
• Ed25519 signature — every proof signed by ArkForge's private key. Public key at GET /v1/pubkey and as a W3C DID Document at GET /.well-known/did.json (did:web:trust.arkforge.tech).
• RFC 3161 timestamps — certified via a pool of trusted timestamp authorities. First success wins; provider recorded per proof.
• Sigstore Rekor — chain hash registered in the Linux Foundation's append-only public transparency log.
• Open proof spec — deterministic format with test vectors. Any third party can verify a proof without ArkForge's code. ark-forge/proof-spec

Payment evidence (Mode B)

• Attach a Stripe receipt URL to any proxy call. ArkForge fetches it directly from Stripe, hashes the raw content (SHA-256), and binds it to the proof. The receipt hash is what counts — it holds even if field parsing fails.
• ArkForge does not intermediate this payment. The proof records what it observed at the PSP.

Agent identity

• Optional X-Agent-Identity / X-Agent-Version headers stored in every proof.
• Identity mismatch across calls is flagged: identity_consistent: false.
• Reputation score (0–100) computed deterministically from proof history. No ML, no reviews. [Formula](#reputation-score).

Compliance reports

Generate framework-mapped compliance evidence from your certified proofs:

| Framework | Identifier | Scope | |-----------|------------|-------| | EU AI Act (Regulation 2024/1689) | eu_ai_act | Articles 9, 10, 13, 14, 17, 22 | | ISO/IEC 42001:2023 | iso_42001 | Clauses 6.1, 8.2, 8.4, 9.1, 9.2, 10.1 | | NIST AI RMF 1.0 | nist_ai_rmf | GOVERN 1.1, MAP 1.1/5.2, MEASURE 1.1/2.5, MANAGE 1.3/4.1 | | SOC 2 Readiness | soc2_readiness | CC6.1, CC6.7, CC7.2, PI1.1, PI1.2, A1.1 |

curl -X POST https://trust.arkforge.tech/v1/compliance-report \
  -H "X-Api-Key: mcp_xxx..." \
  -d '{"framework": "nist_ai_rmf", "date_from": "2026-01-01", "date_to": "2026-03-31"}'

> SOC 2 note: soc2_readiness produces readiness evidence, not a formal SOC 2 audit opinion. A Type II report requires an independent CPA firm accredited by the AICPA.

Triptyque de la Preuve

Every transaction carries the ArkForge mark at three levels:

| Level | Where | For whom | |-------|-------|----------| | Digital Stamp | _arkforge_attestation in JSON body | Machines / agent-to-agent | | Ghost Stamp | X-ArkForge-* response headers | API gateways, middleware, monitoring | | Visual Stamp | Public HTML proof page with color badge | Humans, auditors, regulators |

---

Plans

| Plan | Price | Monthly quota | Overage (opt-in) | TSA | |------|-------|--------------|-----------------|-----| | Free | Free | 500 proofs | Not available | FreeTSA → DigiCert → Sectigo | | Pro | €29/month | 5,000 proofs | €0.01/proof (cap €5–€100) | FreeTSA → DigiCert → Sectigo | | Enterprise | €149/month | 50,000 proofs | €0.005/proof (cap €5–€100) | FreeTSA → DigiCert → Sectigo | | Platform | €599/month | 500,000 proofs | €0.002/proof (cap €5–€100) | DigiCert → Sectigo (FreeTSA skipped) |

API key prefix auto-selects plan, rate limits, and billing mode (mcp_free_* / mcp_pro_* / mcp_ent_* / mcp_plat_*). Overage billing is disabled by default — opt in explicitly at POST /v1/keys/overage.

Platform plan is designed for platforms and AI integrators embedding Trust Layer in their own products. It routes timestamps through DigiCert directly (WebTrust-certified, enterprise-grade) to handle burst workloads reliably.

For custom requirements (eIDAS-qualified timestamps, on-premise deployment): [contact@arkforge.tech](mailto:contact@arkforge.tech)

---

API reference

| Method | Path | Description | |--------|------|-------------| | GET | /v1/health | Health check | | GET | /v1/pricing | Plans and limits | | POST | /v1/proxy | Certified proxy call | | POST | /v1/keys/free-signup | Create free API key | | POST | /v1/keys/setup | Subscribe to Pro, Enterprise, or Platform (Stripe Checkout) | | POST | /v1/keys/portal | Open Stripe Billing Portal | | POST | /v1/keys/overage | Enable/disable overage billing | | GET | /v1/usage | Usage stats and credit balance | | GET | /v1/proof/{proof_id} | Retrieve proof (JSON or HTML) — includes agent_identity, agent_identity_verified, did_resolution_status, and seller; buyer_fingerprint omitted | | GET | /v1/proof/{proof_id}/full | Full proof with payment details — API key + owner required | | GET | /v/{proof_id} | Short URL — redirect to proof | | GET | /v1/proof/{proof_id}/tsr | Download RFC 3161 timestamp file | | POST | /v1/credits/buy | Buy prepaid overage credits | | GET | /v1/pubkey | ArkForge's Ed25519 public key | | GET | /.well-known/did.json | W3C DID Document (did:web:trust.arkforge.tech) | | GET | /v1/agent/{agent_id}/reputation | Agent reputation score (0–100) |

POST /v1/proxy — request body

{
  "target": "https://api.example.com/endpoint",
  "method": "POST",
  "payload": {"task": "analyze"},
  "description": "optional label for the proof",

  // Optional: attach external payment evidence (Mode B)
  "provider_payment": {
    "type": "stripe",
    "receipt_url": "https://pay.stripe.com/receipts/payment/CAcaFwo..."
  },

  // Optional: forward headers to the target API
  "extra_headers": {
    "Authorization": "Bearer token",
    "Accept": "application/json"
  }
}

Optional request headers:

| Header | Description | |--------|-------------| | X-Agent-Identity | Agent's self-declared name | | X-Agent-Version | Agent's version string |

Proxy limits

| Limit | Value | |-------|-------| | Target protocol | HTTPS only | | Payload format | JSON only | | Response timeout | 120 seconds | | Response hashed | 1 MB max (truncated) | | extra_headers | Max 10, max 4096 chars per value | | Monthly quota | 500 / 5,000 / 50,000 (Free / Pro / Enterprise) |

---

Chain hash algorithm

The chain hash formula is public and deterministic. Anyone can recompute it:

chain_hash = SHA256(
  request_hash + response_hash + transaction_id + timestamp +
  buyer_fingerprint + seller
  [+ upstream_timestamp]         // if present in proof
  [+ receipt_content_hash]       // if provider_payment present
)

All values concatenated as raw UTF-8 strings, no separator. Canonical JSON: json.dumps(data, sort_keys=True, separators=(",", ":")).

Verify any proof in one command

PROOF=$(curl -s https://trust.arkforge.tech/v1/proof/prf_...)

REQUEST_HASH=$(echo "$PROOF" | jq -r '.hashes.request' | sed 's/sha256://')
RESPONSE_HASH=$(echo "$PROOF" | jq -r '.hashes.response' | sed 's/sha256://')
PAYMENT_ID=$(echo "$PROOF" | jq -r '.certification_fee.transaction_id')
TIMESTAMP=$(echo "$PROOF" | jq -r '.timestamp')
BUYER=$(echo "$PROOF" | jq -r '.parties.buyer_fingerprint')
SELLER=$(echo "$PROOF" | jq -r '.parties.seller')
UPSTREAM=$(echo "$PROOF" | jq -r '.upstream_timestamp // empty')
RECEIPT=$(echo "$PROOF" | jq -r '.provider_payment.receipt_content_hash // empty' | sed 's/sha256://')

COMPUTED=$(printf '%s' "${REQUEST_HASH}${RESPONSE_HASH}${PAYMENT_ID}${TIMESTAMP}${BUYER}${SELLER}${UPSTREAM}${RECEIPT}" \
  | sha256sum | cut -d' ' -f1)

EXPECTED=$(echo "$PROOF" | jq -r '.hashes.chain' | sed 's/sha256://')
[ "$COMPUTED" = "$EXPECTED" ] && echo "VERIFIED" || echo "TAMPERED"

Current ArkForge public key:

ed25519:ZLlGE0eN0eTNUE9vaK1tStf6AuoFUWqJBvqx7QgxfEY

---

Reputation Score

Every agent gets a deterministic reputation score (0–100) based on proof history alone. No ML, no manual reviews.

score = floor(success_rate × confidence) − penalties

| Volume | Confidence | |--------|-----------| | 0–1 proofs | 0.60 (provisional) | | 2–4 proofs | 0.75 | | 5–19 proofs | 0.85 | | 20+ proofs | 1.00 |

Penalty: −15 if the agent changed its declared X-Agent-Identity across calls.

The score is signed with ArkForge's Ed25519 key. Cached 1 hour,

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: ark-forge
• Source: ark-forge/trust-layer
• License: MIT
• Homepage: https://arkforge.fr

Install and usage instructions live in the source repository linked above.