Receipt
Each action produces a record carrying the authorising policy and the constraints that permitted it. Ed25519 signature over a SHA-256 hash, with a per-agent sequence number and the previous receipt's hash, so entries cannot be reordered.
Signed receipts for AI agents
Not just what your agent did.
Not just what your agent did.
Why it was allowed to.
Every platform can route agent calls and cap the spend. That's now a commodity. What nobody produces is the record of why an action was allowed — and that record is what a compliance team, an auditor, and eventually an insurer relies on, because it doesn't come from the platform being questioned.
One URL change. The gateway is the delivery mechanism. The receipt is the product.
Access is currently limited.
Show a receipt for
receipt · seq 1042
allowed
Covered by the signature
agent_id "reconciliation-bot"
sequence_number 1042
previous_receipt_hash "9f2c…a71e"
source "mcp_gateway"
action "stripe__list_payments"
authorized_result "allowed"
requested_at "2026-09-03T09:41:22Z"
policy_snapshot {
rate_limit_rpm 60
}
Recorded, outside the signature
outcome_type "mcp_tool"
outcome_magnitude { tool: "stripe__list_payments", output_bytes: 8419 }
duration_ms 412
block_reason "rate_limit_exceeded"
The denial itself and the policy that applied are both signed. The human-readable reason is not — and that is the line a regulator reads back.
ed25519 · sha-256 · chained3f9a…c8d1
Govern
Per-agent spend caps, rate limits, and service access policies. Set once on a service, enforced on every call. Changes propagate to all assigned agents instantly.
Integrate
Three gateways. LLM: point your SDK at llm-proxy.lvyer.com — one env var. MCP: add mcp-proxy.lvyer.com as a single MCP server to get all assigned tools. HTTP: route any REST API through http-proxy.lvyer.com/{slug} — one slug per registered upstream, same agent key for all.
Why a separate record
The platform cannot be the witness for itself
Existing governance tools capture what happened. LVYER captures why it was authorised to happen — and the value of that record rests on where it comes from. A platform attesting to its own conduct is self-reporting, and the more of the stack it owns, the less its attestation is worth.
Our thesis is that this separation is what makes the record defensible. It is a positioning argument, and it is what our discovery conversations are testing.
What was authorised
Who acted, under which policy, and whether it was permitted — all inside the signature.
In order, provably
Each receipt carries a sequence number and the hash of the one before it. Entries cannot be reordered.
And what isn't covered
Cost, duration and magnitude are recorded but sit outside the signature. We show you the boundary.
How it works
Drop in. Keep the record.
No SDK changes. No architecture rewrites. Every registered agent's calls pass the gateway and produce a receipt.
01
Register the agent
Name it in the dashboard and get a lvyer_ak_ key back. Shown once, never stored. Assign services with spend caps and rate limits.
02
Point it at LVYER
Set one environment variable. Works with the Anthropic SDK, the OpenAI SDK, or any MCP-compatible client. The request format never changes.
03
Read the receipts
Every call is authenticated, policy-checked and receipted. Filter by agent, service, date and outcome in the audit view.
import anthropic # One URL change — LVYER records the rest client = anthropic.Anthropic( base_url="https://llm-proxy.lvyer.com/anthropic", api_key="lvyer_ak_••••••••••••", ) # ↑ authenticated · policy checked · receipt signed and chained
Start building the record
The record compounds from the day you turn it on.