The code lives in the ProofByte monorepo: oleg-vdv/proofbyte → packages/agent-trace
agent-trace is a ProofByte pack: it inventories the AI agents a codebase
declares and independently verifies their tamper-evident action log — the
traceability evidence an auditor asks for when the question is what did the
agent actually do.
npx @proofbyte/agent-trace scan ./my-repo --out agents.json
npx @proofbyte/agent-trace verify ./journal.jsonl
npx @proofbyte/agent-trace evidence --inventory agents.json --journal journal.jsonl --report evidence.md- scan — MCP server configs, agent-framework imports (LangGraph, CrewAI, AutoGen, OpenAI Agents SDK, Claude Agent SDK, MCP SDK) and workflow files, each with the file it came from and a plain-language reason.
- verify — sequence, chain linkage and per-entry content of a hash-chained JSONL log; returns the chain head and exits non-zero when integrity is broken.
- evidence — an auditor-ready pack where every requirement is marked supported, partial or not-covered. Nothing passes by default.
Regulatory drivers: EU AI Act Art. 12 (record-keeping; high-risk obligations moved to 2 December 2027), Kazakhstan AI Law No. 230-VIII Art. 15, and order No. 95/НҚ on AI-system documentation.
One CI, one release process and one place where issues are triaged beat two of
each — so the package is developed alongside pqc-radar in the monorepo, where
the repository also scans itself on every push. This name is kept so the
project is findable and the npm scope stays unambiguous.
Issues and pull requests: github.com/oleg-vdv/proofbyte/issues
MIT