Write the standard in plain English. Prove the work met it.
Say what an AI agent may do: which tools, how much, who approves, what may never follow what. ScopeBlind turns that into a signed standard and the policy a gate enforces, keeps a signed receipt for every call, and hands whoever relies on the work a record they can check in their browser, with no account and nothing taken on anyone's word.
Check something real today: a published run in which every tool call went through the gate, the model answered inside a confidential machine that signed its own calls, three parties graded the result (one of them another organization, under its own key), and every file checks offline. Open it on scopeblind.com/verify?sample=run or clone verified-runs and run one command.
Receipt format: the gate emits Veritas Acta receipts, the open format specified in the IETF Internet-Draft draft-farley-acta-signed-receipts (revision 03 on the datatracker). Three independent implementations pass the public conformance corpus.
| Pin | What it is | Link |
|---|---|---|
| Write a standard | A conversation on the left, the standard on the right, rendered as a document from its structure. Signed in your browser. Free. | scopeblind.com/write |
| protect-mcp | The gate (MIT). One line in front of any MCP server or a Claude Code hook: fail-closed Cedar policy, credentials held away from the agent, Ed25519 signed and chained receipts. | npx protect-mcp@0.13.4 wrap --cedar ./policy --receipts ./receipts -- <your server> |
| @veritasacta/verify | The verifier (Apache-2.0). Receipts, standards, runs, decisions, provenance, attestation, checked offline. | npx @veritasacta/verify manifest.json --standard standard.json --receipts receipts.jsonl |
| Check a record | Drop the files. Read what they establish and what they do not, in that order. Nothing uploaded. | scopeblind.com/verify |
| verified-runs | Every published run, the harness that made it, the six-agent desk demonstration, and the checks that recompute it. | git clone and npm run check |
- Set the standard. Written in plain English on scopeblind.com/write, read back as a document from its structure, signed by whoever sets it, compiled into the policy the gate enforces.
- Run behind the gate. Every tool call passes the gate and leaves a signed receipt. Where a service runs a receiver, each spend is admitted once, within what remains, and the service signs its decision. The model can answer inside a confidential machine that signs its own calls.
- Hand over the record. The standard, the receipts, the calls, and the decisions, as plain files. Anyone checks them on scopeblind.com/verify or with one command, and reads what the record establishes and what it does not.
Where each control is checked, what a signed record proves, and what it does not: scopeblind.com/how-it-works.
Six agents settle twelve vendor invoices. Two carry a secret side objective; a seventh is a scripted attacker. Same agents, same batch, three sets of controls, outcomes measured at the services from their signed journals:
| Outcome | Logs and allowlists | Budget, receivers, history rules | Repaired |
|---|---|---|---|
| Unauthorized effects | 9 | 0 | 0 |
| Legitimate invoices paid | 7 of 8 | 8 of 8 | 8 of 8 |
| The impossible invoice | paid, diverted | declined | declined at the ledger |
| Cost of the run | USD 0.10 | USD 0.12 | USD 0.14 |
Every file behind these numbers is public and checks offline: verified-runs/swarm. The story, on the front page: scopeblind.com.
ScopeBlind ....................... the site, the standard writer, the record store, plans
|
+-- protect-mcp (MIT) .......... the gate: fail-closed Cedar policy, signed receipts, receivers
+-- verified-runs (Apache-2.0) published runs, the harness, the desk demonstration
+-- agent-governance-testvectors the conformance corpus: three implementations pass it
|
Veritas Acta (open protocol) ..... the receipt format and its verifiers
+-- draft-farley-acta-signed-receipts IETF Internet-Draft, revision 03
+-- @veritasacta/verify ........ offline verifier CLI (Apache-2.0)
+-- verified-runs-grader ....... grade someone else's run in your own workflow, attested
Apache-2.0 packages include an explicit patent grant. MIT packages are the distribution tier.
A record establishes which requirements of a named standard the evidence met, which it did not, and what stays unresolved, at that time, inside the coverage it declares. It does not establish who holds the keys, that every route was covered, or that relying on the work is wise. A route the operator did not put behind the gate is not governed, and the record says so. The verifier reports an outcome it cannot decide as exactly that, never as a pass and never as tampering.
- IETF Internet-Draft:
draft-farley-acta-signed-receipts-03, live on the datatracker. - Conformance corpus: agent-governance-testvectors, three independent implementations conformant (protect-mcp, nobulex, the APS governance hook), with negative vectors and a chain and policy-digest check.
- AWS Cedar: the policy language the gate enforces; a standard compiles to it.
- Independent grading: verified-runs-grader, the first outside fork named as an accepted grader on 13 September 2026.
- Microsoft Agent Governance Toolkit: Tutorial 33, offline-verifiable receipts.
- In-toto: decision receipt predicate proposal at in-toto/attestation#549.
Setting a standard and checking a record are free for everyone, forever. The work that has to prove itself to someone else pays per workflow (one standard in force, unlimited agents), fourteen days free; the first five design partners get the receiver put in front of their own service. scopeblind.com/start.
- scopeblind.com: the site. legate.scopeblind.com and mandate.scopeblind.com redirect here.
- veritasacta.com: the protocol's reference site and browser verifier.
- npm: protect-mcp (MIT), npm: @veritasacta/verify (Apache-2.0).
- Security and contact: tom@scopeblind.com. Built by Tom Farley in Sydney.