{
  "markdown": "# Agent Runtime Proof\n\n**Prove the agent runtime you launched is the artifact you approved.**\n\nAgent Runtime Proof (ARP) is a local, read-only runtime identity verifier for\nAI agents and MCP servers. It detects stale, replaced, mismatched, or\nunverifiable runtimes without uploading code, secrets, process arguments, or\nprocess data.\n\nThe failure ARP is built for is simple: you replace an Agent or MCP executable,\nbut yesterday's process keeps doing the work. The file on disk is new; the\nloaded runtime is not. ARP binds live process identity to an explicit artifact\nexpectation and reports the uncertainty instead of treating the file on disk as\nproof of what is running.\n\nSee the [reproducible stale-runtime demonstration](docs/demo.md), or start with\nthe [five-minute quickstart](docs/quickstart.md).\n\n## Quickstart\n\nThe current release is\n[v1.1.0](https://github.com/fantasyce/agent-runtime-proof/releases/tag/v1.1.0)\nfor macOS arm64, Linux amd64, and Windows amd64. Download the archive and\n`SHA256SUMS` from that release, verify the bytes, then install the single binary\nin a user-owned directory. Full commands for each platform are in\n[docs/quickstart.md](docs/quickstart.md); lifecycle and rollback details are in\n[docs/install.md](docs/install.md).\n\nAfter installation:\n\n```bash\nagent-runtime-proof --version\nagent-runtime-proof doctor --format json\nagent-runtime-proof inspect --all --limit 20\n```\n\nVerify a process against an explicit expectation:\n\n```bash\nagent-runtime-proof verify \\\n  --expectation /absolute/path/to/expectation.json \\\n  --pid 1234 \\\n  --format json\n```\n\nARP returns `MATCHED` only when the evidence supports that conclusion.\n`UNKNOWN`, `STALE`, `LEAKED`, `CONFLICT`, and `NOT_RUNNING` are domain verdicts,\nnot transport errors.\n\n## Local stdio MCP\n\nARP can run as a local MCP server:\n\n```json\n{\n  \"mcpServers\": {\n    \"agent-runtime-proof\": {\n      \"command\": \"/absolute/path/to/agent-runtime-proof\",\n      \"args\": [\"mcp\"]\n    }\n  }\n}\n```\n\nIt exposes exactly three read-only tools:\n\n- `list_local_runtime_candidates`\n- `inspect_local_runtimes`\n- `verify_local_runtime`\n\nHost profiles are available for Codex, Claude Code, Cursor, OpenCode, DeepSeek\nHarness, VS Code/GitHub Copilot, and generic hosts. See\n[the host configuration guide](docs/host-configuration.md). ARP does not edit\nthe host's configuration.\n\nThe v1.1.0 Release also includes\n`agent-runtime-proof_1.1.0.mcpb` for compatible MCP clients. Its Registry\nmetadata binds the bundle URL to its SHA-256 digest; the same three native\nbinaries remain available as ordinary platform archives.\n\nThe same release is published in the\n[official MCP Registry](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.fantasyce%2Fagent-runtime-proof/versions/1.1.0)\nas `io.github.fantasyce/agent-runtime-proof`.\n\n## What ARP proves\n\nThese controls answer different questions and work best together:\n\n| Evidence | Question it answers |\n| --- | --- |\n| SBOM | What dependencies were declared in this build? |\n| Signature or build attestation | Who produced these artifact bytes, and through which build? |\n| Checksum | Did the downloaded bytes change? |\n| Agent Runtime Proof | Is the live local process bound to the artifact expectation I approved? |\n\nARP does not replace signing, provenance, SBOMs, sandboxing, or host policy. It\ncloses the gap between an approved file and the process that is actually doing\nthe work.\n\n## Privacy and safety boundary\n\nARP is intentionally narrow:\n\n- local processes and local files only;\n- CLI, local `stdio` MCP, and an optional launch Witness;\n- read-only observation of Agent and host state;\n- no daemon, network listener, repair action, or configuration write;\n- no dependency on Across Agents Assistant, Across Context, Across\n  Orchestrator, or Across Autopilot.\n\nMCP responses omit raw argv, environment values, command lines, file contents,\ncredentials, and transcripts. Read the exact guarantees and limitations in\n[docs/data-handling.md](docs/data-handling.md),\n[docs/privacy-model.md](docs/privacy-model.md), and\n[docs/threat-model.md](docs/threat-model.md).\n\n## CLI and Witness\n\nInspect one process or a bounded current-user inventory:\n\n```bash\nagent-runtime-proof inspect --pid 1234 --format json\nagent-runtime-proof inspect --all --limit 100\n```\n\nRun a local command through the byte-transparent launch Witness:\n\n```bash\nagent-runtime-proof witness --expectation expectation.json -- command arg\n```\n\nThe Witness records process identity and a content-addressed launch receipt,\nthen proxies stdin/stdout without rewriting protocol bytes. Hosts that own\nprocess creation can embed the same contract through `sdk/witness`.\n\nExit codes are `0` for inspection, doctor, or `MATCHED`; `2` for a determinate\nnegative verdict; `3` for `UNKNOWN`; `64` for invalid input; and `70` for an\ninternal failure. JSON mode writes one JSON value to stdout; sanitized\ndiagnostics use stderr.\n\n## Supported platforms and limits\n\nRelease archives are built for macOS 14+ arm64, Linux amd64, and Windows 11\namd64. Passive inspection of interpreter and declared-tree runtimes remains\nconservative when the active entrypoint cannot be observed. An on-disk digest\nalone is never reported as a loaded-runtime match.\n\nRemote attestation, a daemon, network listeners, repair actions, and Agent\nconfiguration writes remain outside v1.\n\n## Architecture and acceptance\n\nThe same contracts and application layer drive the CLI, MCP server, Witness,\nand data-only Host Profiles. Technical design is documented in\n[architecture-development-acceptance.md](docs/architecture-development-acceptance.md).\n\nAcceptance records:\n\n- [Phase 0 contracts](docs/phase0-acceptance.md)\n- [Phase 1 macOS core](docs/phase1-macos-acceptance.md)\n- [Phase 1 Windows core](docs/phase1-windows-acceptance.md)\n- [Phase 2 MCP](docs/phase2-acceptance.md)\n- [Phase 3 Witness](docs/phase3-acceptance.md)\n- [Phase 4 host matrix](docs/phase4-acceptance.md)\n- [Phase 5 open-source release](docs/phase5-acceptance.md)\n\nMaintainers can run the complete source gate with:\n\n```bash\nbash scripts/check.sh\n```\n\nRelease assets include CycloneDX SBOMs, SHA-256 checksums, and GitHub artifact\nattestations. Publication state is determined by the public GitHub Release, not\nby a local acceptance record.\n\n## Agent Reliability Toolkit\n\nARP is one independent part of a small, local-first reliability toolkit:\n\n- [Agent Runtime Proof](https://github.com/fantasyce/agent-runtime-proof) verifies that a live Agent or MCP runtime matches the artifact you approved.\n- [Agent Residue Evidence](https://github.com/fantasyce/agent-residue-evidence) records task-scoped files, processes, and listening ports left by tests and builds.\n- [DSH TypeLens](https://github.com/fantasyce/dsh-typelens) adds bounded type context and edit diagnostics to DeepSeek Harness.\n\nEach project remains separately installable and keeps its own trust boundary.\n\n## Community\n\nContributions and independent host/runtime cases are welcome. Read\n[CONTRIBUTING.md](CONTRIBUTING.md), [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md),\nand [SUPPORT.md](SUPPORT.md). Report vulnerabilities privately as described in\n[SECURITY.md](SECURITY.md); do not put secrets or sensitive process data in a\npublic issue.\n\nApache-2.0 licensed. See [LICENSE](LICENSE).\n",
  "bytes": 7273,
  "sha": "b061eb595e18c3e357c2824db66a5a101830eb54cbcfb7115dbfd07c17345f85",
  "repo_slug": "fantasyce/agent-runtime-proof",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_fantasyce_agent_runtime_proof_f9f2fbe4/readme"
}