TrustNotch
Submit, retrieve, and cryptographically verify tamper-evident audit logs for AI agent actions so you can ship and operate agents with defensible proof bundles.
Overview
TrustNotch is a Ship-phase Security MCP server that lets agents submit, fetch, and verify tamper-evident audit logs and cryptographic proof bundles via the TrustNotch API.
What is this MCP server?
- stdio MCP via PyPI package trustnotch-mcp with runtime hint uvx
- Submit, fetch, and verify tamper-evident audit logs with cryptographic proof bundles
- Required TRUSTNOTCH_API_KEY (tn_live_... or tn_test_...)
- Optional TRUSTNOTCH_PUBKEYS_PATH for offline public-key pinning verification
- Configurable TRUSTNOTCH_API_URL defaulting to https://api.trustnotch.com
- Package version 0.1.0 on PyPI identifier trustnotch-mcp
- Default API base https://api.trustnotch.com
- Three documented environment variables (one required secret API key)
What problem does it solve?
You cannot prove what your AI agent did after the fact, which blocks security reviews, enterprise sales, and calm incident response.
Who is it for?
Indie builders shipping agents to paying users who need audit trails, compliance-friendly evidence, or post-incident verification without building crypto logging from scratch.
Skip if: Hobby projects with no accountability requirements or teams that only need unstructured debug console output.
What do I get? / Deliverables
Agent actions land in tamper-evident logs with verifiable proof bundles you can check in chat or offline with pinned public keys.
- Submitted tamper-evident audit events from agent workflows
- Fetched log records and proof bundles for review
- Verified integrity of audit data using API or pinned public keys
Recommended MCP Servers
Journey fit
Tamper-evident audit trails are canonical on the Ship/security shelf because they address accountability before and after launch, even though logging also supports Operate monitoring. Security subphase fits submit/fetch/verify proof bundles that defend against repudiation and support compliance narratives, not generic error dashboards alone.
How it compares
Cryptographic audit-log MCP for agents, not a generic application performance monitoring server.
Common Questions / FAQ
Who is TrustNotch MCP for?
Developers running Claude Code, Cursor, or similar agents who need tamper-evident audit logs and verifiable proof bundles for production or pre-launch agent workflows.
When should I use TrustNotch MCP?
During Ship security hardening and Operate monitoring when you must record agent actions, export evidence for reviewers, or verify logs were not altered.
How do I add TrustNotch MCP to my agent?
Install trustnotch-mcp from PyPI (uvx runtime hint), set TRUSTNOTCH_API_KEY, optionally TRUSTNOTCH_API_URL and TRUSTNOTCH_PUBKEYS_PATH, and register the stdio server in your MCP client.