THE INSTRUMENT · APACHE-2.0

Witness, before you run it.

Witness is the recorder a Flight Check runs on: a transparent MCP proxy that records tool calls and server responses through the servers you wrap. It is open source, so you can read it before it executes in your environment. This page explains what its records show, what they cannot prove and what you can choose to share.

WHAT IT IS

A recorder at the tool boundary.

Witness records the tool call, the declared principal and the server's response at the MCP boundary. Its hash chain lets you check the supplied record for internal consistency. It does not verify identity or independently prove the action's downstream effect.

STDIO PROXY

It sits between any MCP client and any MCP server.

Claude Code, Claude Desktop, Cursor, Cowork or your own harness on one side; any stdio MCP server on the other. JSON-RPC frames relay through untouched. On the way past, each tool call and its result are digested into an append-only log.

HTTP / SSE

Remote servers too.

A loopback reverse proxy for Streamable HTTP and SSE servers. Bodies relay byte-for-byte. The Authorization header passes through and is never recorded. An unreachable upstream answers a JSON-RPC 502 and the call seals as unknown rather than vanishing.

WRAP

It installs by rewriting config you already have.

Auto-detects project .mcp.json, ~/.claude.json, Cursor's mcp.json and Claude Desktop. Reversible, idempotent, dry-runnable, and it keeps a backup. Uninstalling is restoring that backup.

CHAIN

Every record is chained to the one before it.

Each entry carries the SHA-256 of its predecessor. verify checks the supplied chain's hashes and links, and exits non-zero on the first mismatch. This checks internal consistency, not the log's origin or completeness.

REDACTION

Payloads are hashed. Summaries need review.

Full arguments and results are stored as digests. Optional allow-listed summaries contain plaintext. Keys matching token, secret, password, authorization, cookie, api_key or credential are excluded from summaries. Other values and metadata can still be sensitive.

READING

The commands that turn records into answers.

tail follows a live session; sessions lists them; query filters by tool, server, principal, status or time; report produces a markdown digest with error rate and p50/p95 latency per tool; anchor appends chain heads to a checkpoints file that is itself chained.

THE TWO RULES

What the design refuses to trade.

Two constraints govern every decision in the recorder. They are the reason it is useful in an audit and the reason it is safe to leave running.

Absence of evidence is never evidence of absence.

If the server exits before it answers a call, Witness records the outcome as unknown. Unwrapped activity is outside the record. An empty log does not establish a quiet or safe estate.

Relay first, record second.

Nothing in the recording path may delay, alter or drop a frame. If the recorder cannot write its log it says so on stderr and keeps relaying. Recording can be lost; uptime cannot.

WHAT IT DOES NOT CLAIM

The limits, stated first.

A security tool that oversells itself is worse than no tool, because it buys confidence it has not earned. These are the things Witness cannot do in this version, listed here rather than discovered by you in week two.

No proven identityPrincipals are labels your harness declares, with verified: false. A tool result records the server's response, not independent proof of a downstream change. Neither record proves who acted or approved an action.
No session signatures or external timestampSession records are unsigned. Optional signatures cover judge and feed records only. Chain verification checks internal consistency; it does not establish who produced a session log or independently verify its timestamps.
No enforcementIt records. It does not block, approve, rewrite or rate-limit a single call. If you want a gate, this is not that product.
No inventory of what you did not wrapOnly tool calls through wrapped MCP servers are observed. Unwrapped activity is outside the record. Silence does not establish safety or complete coverage.
No proof of an unchanged originalA replaced, consistently recomputed session log can pass verification. Detecting that replacement requires a trusted copy or a separately retained checkpoint. Verification alone cannot establish that an export matches the original log.

READ IT YOURSELF

The source, and the documents that bound it.

Apache-2.0, zero runtime dependencies, one file you can read in an afternoon. Complete for one engineer, free, forever - the Flight Check is where an organisation buys the reading of it, not the tool.

Witness on GitHub ↗See its output on our own estate →

TWO WEEKS · $7,500 · LOCAL RECORDS, REVIEWED EXPORTS

The tool is free. The reading is the work.

Run Witness yourself for nothing, for as long as you like. A Flight Check is what happens when someone who has read a few thousand of these records sits down with yours.

Book the readout call →See the Flight Check →