Agent guardrails, with a receipt
Provenrail stops it, and writes a receipt that cannot be altered without the change showing. One command puts
guardrails at your agent's own tool boundary, so rm -rf, terraform
destroy, force pushes and leaked keys are blocked before they run. Every
decision is signed and hash-chained off-box, verifiable by anyone with an open-source
tool that trusts neither the agent nor us.
In April 2026 an AI coding agent deleted a production database and every backup in nine seconds. There was no forensic record of what it was asked to do. The incidents, and what would have stopped them →
Free tier. No credit card. Installs in seconds. See how it compares.
Honest scope: guardrails cover the tool calls your agent routes through its hooks, and a record is immutable and verifiable once it reaches the sink. Completeness is never claimed: a process that never calls the hook will not appear. We state this plainly rather than bury it. See the full threat model.
If you use Claude Code, pr guard install arms the destructive, secrets and
production rule packs and wires them into its own tool hooks. No SDK, no code change.
There is also an installable Claude Code plugin
if you would rather not touch a settings file.
For your own agents there is a Python and TypeScript SDK, with drop-in capture
for the OpenAI and Anthropic clients, LangChain and MCP. A run recorded in either
language produces the same bytes and verifies with the same open-source tools, and a
cross-language test in CI fails the build if that ever stops being true.
uv tool install provenrail / npm install provenrail
Read the quickstart guide# 1. Install, and arm the guardrails (no account, nothing leaves the box) $ uv tool install provenrail $ pr quickstart && pr guard install # 2. Your agent tries something destructive > rm -rf ./src blocked destructive.recursive-force-remove # 3. The block is signed evidence. Check it yourself. $ pr guard receipt 1 DENIED rm -rf ./src $ pr verify guard-receipt.json RESULT: VERIFIED
The design is simple by intention: fewer moving parts to trust means less to audit.
One with pr.record() block captures every model and tool call wherever your agent makes decisions. Each event is hashed and sequenced on the client before it leaves your process.
Each record carries a hash of the previous one, forming a chain. The sink is append-only: records cannot be deleted or reordered without breaking the chain. On Builder and higher plans, RFC 3161 timestamps from an independent authority anchor the sequence so back-dating is detectable; the Free plan hash-chains the sequence without a third-party timestamp.
The open-source pr-verify tool reconstructs the chain and validates every anchor independently. Export your bundle and share it with a client, auditor, or regulator who runs the same tool; on Builder and higher a hosted read-only proof link is also available. They trust the math, not you.
Try it right here
Below is a real Provenrail record, verified live in your browser. Flip a single character and the open-source verifier rejects it. This is the whole idea, and you do not have to trust us to see it.
Runs entirely in your browser via the open-source verifier. Your data never leaves your device, not even to us.
Real terminal sessions, no mockups. Every command and every output below is captured verbatim from a live run.
rm -rf and terraform destroy are blocked and the block is signed evidence.
pr quickstart, pr demo, pr verify.
pr activate your server.
record() to pr report and a portable evidence pack.
For freelancers and agencies
When you deliver an autonomous agent project to a client, billing disputes and scope-creep questions are inevitable. Provenrail gives you a verifiable record of exactly what the agent did, when, and in what order. No more "the agent went rogue" conversations.
For developers with production-access agents
Agents with access to money, production infrastructure, or email can cause real damage. After an incident you need a reconstruction, not speculation. Provenrail gives you a verifiable sequence of every decision the agent made, in the exact order it made them.
For teams with regulatory exposure
EU AI Act Article 12 logging requirements apply from 2027-12-02 for standalone high-risk systems, deferred from 2026-08-02 by Regulation (EU) 2026/1744. HIPAA 164.312(b) requires audit controls for systems handling protected health information. Provenrail provides an append-only, timestamped, tamper-evident event log designed to serve as technical evidence in regulatory contexts. Certification and any formal attestation remain your responsibility, and we issue neither.
Most observability tools ask you to trust them. Provenrail is designed so that you do not have to.
The pr-verify tool is open-source and runs entirely offline. Any party can check the chain without contacting our servers. Trust the math, not the vendor.
On Builder and higher plans, each anchor is timestamped by an external authority using the RFC 3161 standard, so the timing cannot be back-dated, even by us. The Free plan hash-chains ordering without a third-party timestamp.
An independent off-box receipt chain closes the single-host rewrite gap on every plan. On Builder and higher, an append-only Merkle log cosigned by independent witnesses closes the equivocation gap too, and every inclusion is emitted as an IETF SCITT (COSE) receipt any standards-aware auditor can verify.
Default mode stores a SHA-256 hash of each prompt and response, not the raw text. Selective-disclosure redaction lets you reveal or erase sensitive fields later, without breaking the proof.
Drop-in capture for the OpenAI and Anthropic clients, LangChain and MCP. Any other provider or framework, Gemini, local models, or a custom loop, records with one line, all to the same chain.
We document exactly what Provenrail does and does not catch. Technical buyers trust specificity. We tell you what we cannot guarantee before you commit to a plan.
The agent signs and links each record; the sink independently re-chains them in arrival order. Rewrite the agent's chain and the sink's stored bytes catch it. Edit the sink's bytes and the agent's signatures catch it. Getting away with a change means breaking both at once.
A Python verifier and a JavaScript one are held to 12 frozen public test vectors in CI, and every release must satisfy both. Build a third from the spec and check it against the same vectors. That is what "independently verifiable" is made of, rather than asserted.
When a headless agent needs a human, an unanswered request, an expired link and an unreachable sink all leave the action blocked. Only a person pressing the button on the review page releases it, and that decision is signed into the same record.
No email gate on pricing. No hidden fees. Cancel anytime.
pr report), run on a bundle you export yourselfpr pack), the same waypr verify-content)Every plan includes full hash-chain integrity and the open-source verifier, identical on every tier. Paid plans add RFC 3161 trusted timestamps, shareable proof links and a live badge (Builder); then up to 10 team members with roles and SSO, data exports, and evidence packs mapped to EU AI Act Article 12 and HIPAA audit-control requirements (Team). Limits apply to the licensed build you run. We host no agent records. 14-day refund on paid plans.
pr-verify) is open-source and verifies the hash chain locally without contacting our servers. On Builder and higher plans it also checks RFC 3161 timestamps from an external time authority. You can run it yourself, or export a portable bundle and hand it to any third party who runs the open-source verifier; on Builder and higher a hosted read-only proof link is also available. You do not need to trust us or the agent; you need to trust standard cryptography and, on paid plans, the third-party time authority.uv tool install provenrail (or pip install provenrail inside a virtualenv). Export your stream as a bundle, then run: pr verify bundle.json --pin pin.json. The tool recomputes the client hash chain, every Ed25519 signature, the independent server receipt chain, and every anchor locally, trusting neither the agent nor the sink. On Builder and higher plans each anchor carries an RFC 3161 trusted timestamp that the tool verifies against the external time authority. It exits 0 if intact and non-zero with a detailed error if any record is missing, reordered, altered, or back-dated. You can hand the bundle to a third party to run the verifier themselves; on Builder and higher a hosted read-only proof link is also available.