Skip to content
Get packs

Signed Audit Trails Recipe

Set up signed, tamper-evident logs of every Claude Code tool call for later verification

Source Download skill
Repository
wshobson/agents
Stars
42,095
Licence
MIT
Files
5 files

What it does

This skill is a step-by-step guide for adding a verifiable paper trail to an AI coding agent. Once set up, each tool call the agent makes (reading, editing, running shell commands, fetching web pages) is checked against a written policy first, then recorded as a cryptographically signed receipt. Anyone holding the public key can later check that the receipts are intact and were not altered, without trusting the person who ran the agent. It is mainly a teaching and demonstration guide; the actual runtime hooks come from a separate protect-mcp plugin.

Great for

  • Developers evaluating whether tamper-evident logging of agent actions is worth adopting
  • Teams in regulated or compliance-heavy settings who need evidence of what an automated agent did
  • CI/CD owners who want proof that a policy gate ran on every automated build step

Skip it if

  • Casual users who just want a summary of agent activity; the setup adds hooks, keys and verification steps and is overkill for that
  • Anyone who would commit the signing key to a repository or run the CI workflow on pull requests, since that exposes the private key to unreviewed code and undermines the audit trail

Try asking

  • “Walk me through setting up signed audit receipts for Claude Code tool calls”
  • “Explain how the Cedar policy in this recipe decides which Bash commands are allowed”
  • “Show me how to verify my receipts and demonstrate tamper detection”
  • “Help me add a GitHub Actions step that verifies receipts in CI”
Step-by-step guide: how to use Signed Audit Trails RecipeInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 5 original files, the MIT licence and an attribution note.

    signed-audit-trails-recipe.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip signed-audit-trails-recipe.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip signed-audit-trails-recipe.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the setup in a throwaway project first to understand the receipt flow before applying it to real work
  • Keep protect-mcp.key out of version control and share only the publicKey value with auditors
  • Note that receipts do not chain to each other, so a deleted receipt is not detected; add your own retention controls if completeness matters

What's inside

  • references/cedar-policy.md
  • references/ci-cd.md
  • references/hook-wiring.md
  • references/receipt-format.md
  • SKILL.md

Redistributed unmodified from wshobson/agents under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.