Receipt
Each action produces a record carrying the authorising policy and the constraints that permitted it. Ed25519 signature over a SHA-256 hash, with a per-agent sequence number and the previous receipt's hash, so entries cannot be reordered.
Signed receipts for AI agents
Not just what your agent did.
Not just what your agent did.
Why it was allowed to.
Every platform can route agent calls and cap the spend. That's now a commodity. What nobody produces is the record of why an action was allowed — and that record is what a compliance team, an auditor, and eventually an insurer relies on, because it doesn't come from the platform being questioned.
One URL change. The gateway is the delivery mechanism. The receipt is the product.
Access is currently limited.
Show a receipt for
receipt · seq 1042
allowed
Covered by the signature
agent_id "reconciliation-bot"
sequence_number 1042
previous_receipt_hash "9f2c…a71e"
source "mcp_gateway"
action "stripe__list_payments"
authorized_result "allowed"
requested_at "2026-09-03T09:41:22Z"
policy_snapshot {
rate_limit_rpm 60
}
outcome_type "mcp_tool"
outcome_magnitude { tool: "stripe__list_payments", output_bytes: 8419 }
duration_ms 412
block_reason "rate_limit_exceeded"
The denial, the policy that applied, and the reason are all signed. What was stopped is as attested as what was permitted.
ed25519 · sha-256 · chained3f9a…c8d1
Govern
Per-agent spend caps, rate limits, and service access policies. Set once on a service, enforced on every call. Changes propagate to all assigned agents instantly.
Integrate
Three gateways. LLM: point your SDK at proxy.lvyer.com — one env var. MCP: add mcp.lvyer.com as a single MCP server to get all assigned tools. HTTP: route any REST API through http.lvyer.com/{slug} — one slug per registered upstream, same agent key for all.
Why a separate record
The platform cannot be the witness for itself
Existing governance tools capture what happened. LVYER captures why it was authorised to happen — and the value of that record rests on where it comes from. A platform attesting to its own conduct is self-reporting, and the more of the stack it owns, the less its attestation is worth.
Our thesis is that this separation is what makes the record defensible. It is a positioning argument, and it is what our discovery conversations are testing.
What was authorised
Who acted, under which policy, and whether it was permitted — all inside the signature.
In order, provably
Each receipt carries a sequence number and the hash of the one before it. Entries cannot be reordered.
The full outcome is signed
Outcome type, magnitude, duration, and any denial reason are inside the signature. The complete picture of what happened is attested, not just whether it was permitted.
How it works
Drop in. Keep the record.
No SDK changes. No architecture rewrites. Every registered agent's calls pass the gateway and produce a receipt.
01
Register the agent
Name it in the dashboard and get a lvyer_ak_ key back. Shown once, never stored. Assign tools with per-agent spend caps and rate limits.
02
Point it at LVYER
Set one environment variable. Works with the Anthropic SDK, the OpenAI SDK, or any MCP-compatible client. The request format never changes.
03
Read the receipts
Every call is authenticated, policy-checked and receipted. Filter by agent, source and outcome in the audit view.
import anthropic # One URL change — LVYER records the rest client = anthropic.Anthropic( base_url="https://proxy.lvyer.com/anthropic", api_key="lvyer_ak_••••••••••••", ) # ↑ authenticated · policy checked · receipt signed and chained
Start building the record
The record compounds from the day you turn it on.