Self-hosted alternatives to signed-audit-trails-recipe

S

signed-audit-trails-recipe

Step-by-step cookbook

signed-audit-trails-recipe is an agent skill from the wshobson/agents collection that is a step-by-step cookbook for setting up cryptographically signed audit trails on Claude Code tool calls. It is the teaching companion to the protect-mcp plugin, which provides the runtime implementation. The idea is that every tool call, such as a Bash command, an Edit, a Write or a WebFetch, is evaluated against a Cedar policy before it runs, so a call the policy denies does not execute, and is then recorded as an Ed25519-signed receipt after it runs. The receipts use a canonical JSON form and can be verified offline by anyone holding the public key, so an auditor or counterparty can check the record later without contacting the operator. The skill walks through what this gives you, when the pattern is worth using, and the steps to set it up and verify the receipts. It is intended for teams that need evidence of what an agent did, for example in regulated work, and for people evaluating or demonstrating the approach before adopting it. The recipe shows the mechanism, and the runtime setup is handled by the plugin the recipe refers to. The skill is installed with the skills CLI from the wshobson/agents repository. Its skills.sh page showed about 5.9K installs and passing results from three security audits at the time of the scan.