Witness overview
Witness is an open-source recorder for AI agents. It sits between an MCP client, such as Claude Code, Claude Desktop or Cursor, and the MCP servers that client uses. Each tool call and its result pass through untouched and are written to an append-only log on your machine. It is licensed Apache-2.0. The source is on GitHub.
What it records
Section titled “What it records”- Tool calls through wrapped servers. Local stdio servers through a proxy, and remote HTTP or SSE servers through a loopback reverse proxy.
- A hash chain. Each record carries the SHA-256 of the record before it, so a changed or missing record breaks the chain.
- Digests, not payloads. Full arguments and results are stored as hashes. Optional plaintext summaries are allow-listed per server, and keys such as token, secret, password, authorization, cookie, api_key and credential are always left out.
- Unanswered calls. If a server exits before it answers, the call is recorded as unknown, not as a success.
What it does not claim
Section titled “What it does not claim”- It does not prove who acted. Principals are labels your harness declares, marked
verified: false. - It does not block or approve anything. It records.
- It does not see activity through servers you did not wrap. An empty log is not proof of a quiet estate.
- A chain check proves internal consistency only. It does not prove a log is the original or is complete.
- Install and wrap your servers
- Verify a log
- Witness Reading: we read your records for you, as a service.