Pipelock vs Agent Evidence Tools

The short version

Every tool on this page records agent actions, but the protection against later editing depends on its signature, key custody, or external witness. They differ on the three questions an auditor will ask.

Who holds the signing key? Where does the recorder sit relative to the agent? Can I verify the record without contacting the vendor?

Pipelock is an agent firewall. It sits outside the agent process on the routed network path and inspects mediated MCP, HTTP, and WebSocket traffic. With an Ed25519 signing key configured, it can emit signed action receipts for mediated decisions. The shipped verifier works offline.

Attested Intelligence is an MCP governance proxy. It evaluates tool calls against policy, signs a receipt per decision with a deployer-held Ed25519 key, and exports Merkle-bundled evidence with three reference verifiers. MCP only.

Asqav is a hosted evidence service with an SDK. By its own description it’s an unaffiliated third party that signs each agent action server-side with its own keys, using ML-DSA-65 post-quantum signatures, and publishes a JWKS. Customer-managed keys and a self-hosted signer are documented alternatives. The verifier is public and works offline.

Obsigna is the Apache-2.0 reference toolchain for the Agent Receipts protocol. Its README describes an out-of-process signing daemon that holds the key and owns the audit chain, an MCP proxy that signs every tool call and adds policy hooks, a hook for coding agents, a CLI that browses and verifies receipt databases, and Go, Python, and TypeScript SDKs that verify one another’s receipts against a shared conformance suite. It is small and new, and pushed the day this page was checked.

Halo-record is an in-process recorder. It appends SHA-256 hash-chained records to a local file from framework callbacks, hooks, or ingested telemetry. No signatures by design. Verification recomputes the chain; an opt-in witness and an RFC 3161 timestamp add an outside anchor.

The comparison

What the differences mean

Mediator versus in-process. A recorder that runs inside the agent process can only record what the agent chooses to call it for. A compromised or misbehaving agent can skip it. A mediator records traffic that crosses its path, but it does not see traffic that bypasses that path. Pipelock and Attested Intelligence are mediators. Halo-record’s README is candid that its framework adapters fail open: if a record can’t be written, the action completes and the record is lost.

Deployer key versus vendor key. With Pipelock, Attested Intelligence, Obsigna, and Halo-record’s optional anchors, you hold the material. Asqav inverts that on purpose: its pitch is that a third party the agent’s operator doesn’t control does the signing, so the recorded party can’t forge or backdate. That’s a real property, and it means you trust Asqav’s service and key directory instead. Its docs also offer customer-managed KMS keys and a self-hosted signer for buyers who want the key out of the vendor’s database.

Coverage. Attested Intelligence and Obsigna receipt MCP tool calls, and Obsigna also takes coding-agent hook events. Halo-record records whatever adapters feed it. Asqav signs whatever the SDK is asked to sign. With a signing key configured, Pipelock can receipt decisions on its mediated network path, and the decision carries the reason from inspection.

Post-quantum. Asqav signs with ML-DSA-65 today. Attested Intelligence specifies a hybrid but signs with Ed25519 live. Pipelock signs with Ed25519. Of the five tools on this table, Asqav is the one whose documented default is a post-quantum signature.

Where the others are stronger

A signer you don’t control. Asqav’s hosted service holds the signing authority by default, rather than the agent operator. Its documented default signature is post-quantum.

Hooks inside the agent. Obsigna takes coding-agent hook events, so it records steps that never touch the network. Attested Intelligence receipts the policy decision on each MCP tool call with a purpose-built format. Halo-record runs in-process with no proxy to deploy.

What none of them prove

A verified chain proves the records present are authentic and in order. It doesn’t prove non-omission: that every action the agent took produced a record. Attested Intelligence’s README says so. Halo-record’s LIMITS document says so. Obsigna’s formal chain-invariant check names the Byzantine key holder as the boundary it does not cover. Pipelock’s receipts cover mediated traffic, and traffic that bypasses the proxy leaves no receipt.

A deployer-held key proves what the mediator decided. It doesn’t make the operator independent of the evidence. The honest phrasing for all of them is: verify the signature yourself, offline, without a server.

Not on this table

Two more projects came up in research and were left off. CertNode publishes a receipt format and a verify-only npm package, but its website answered every request with a paused-deployment notice on the date checked and the source repository path in the package metadata didn’t resolve, so key custody couldn’t be confirmed from a primary source. Hopframe is a BSL-licensed alpha with signed hash chains and Sigstore anchoring on paper, and a single maintainer; the claims weren’t exercised. Both may earn a row later.

Further reading

• Pipelock vs Attested Intelligence: the closest one-to-one comparison
• Action receipt spec: Pipelock’s receipt format
• Flight recorder: the hash-chained record behind the receipts
• Proof: Pipelock’s public receipts and verifier
• Pipelock vs Microsoft AGT: an in-process governance SDK with its own audit chain
• Pipelock on GitHub