Complementary evidence layer: offline-verifiable cryptographic attestation for agent sessions (iqa-mcp)

[Aicent-com]

The Agents SDK packs a lot into one primitive — Durable Objects for state, WebSocket/RPC for real-time communication, and first-class MCP serving (an Agent can itself act as an MCP server over HTTP, SSE or RPC). One gap worth considering for agents built on it:

The gap: what an agent did — which tool, on whose behalf, with what intent, under what authorization — lives in the operator's logs, if anywhere. Logs answer "what happened" for the operator; they cannot be handed to an external party (auditor, downstream service, compliance framework, or even the user the agent acted for) as independently verifiable evidence. A log can be edited after the fact; the verifier has no choice but to trust the operator.

Suggested direction: an optional evidence layer alongside the SDK's state and communication primitives — compact cryptographic attestations emitted as agents act, verifiable offline by anyone, forever, with zero round-trips. We open-sourced a minimal reference implementation that works with any MCP-capable agent:

• iqa-mcp (Apache-2.0, on PyPI): four MCP tools — derive_route_shard (intent-address derivation from any authority, no registry) / parse_envelope (128-byte AE-128 attestation envelope) / verify_envelope (constant-time HMAC-SHA256 full-frame verification + lease check, fail-closed) / published_vector (conformance test vectors for byte-level self-checks)

• Reference implementation: iqa-org v1.3.1 (PyPI / npm / crates.io)

• Specification: IETF Independent Submission draft draft-li-rttp-iqa-addressing (in review)

Positioning — complement, not replacement: the SDK handles real-time state and transport; the evidence layer proves after the fact. It requires no changes to the SDK — an Agent that already serves MCP can emit attestations through iqa-mcp as a separate MCP server alongside it. No detection or governance logic is added to the SDK.

The published_vector tool follows the reproducibility spirit: results anyone can re-verify byte-for-byte, not just trust.

Happy to draft a short integration sketch (an Agent subclass emitting envelopes alongside tool calls) if useful.