Logs tell you what your agent did. Vitnify proves it — a cryptographic receipt of every run, reproducible bit-for-bit by anyone, long after it happened.
Capabilities
vitnify isn't detection. It gives you the primitives to contain an agent, reproduce exactly what its model computed, and prove it to anyone — the receipt is an execution certificate under the hood.
Scope every tool an agent may touch. Ungranted actions are structurally unreachable — even to a fully compromised agent.
Re-run any past run and get the identical result. Reproduce an incident exactly, for debugging or forensics.
Bind the model's exact computation, every tool call, the results, and their order into one tamper-evident, signed object.
Anyone can verify a receipt with no model, no network, and no secret. Integrity is third-party checkable.
The recompute reproduces exactly across CPU vendors and instruction sets — your proof isn't tied to one machine.
Wrap existing LangGraph and MCP agents. No changes to your agent logic, no new runtime to adopt.
Validated: three models across two architecture families reproduce bit-identically on Apple, Arm, Intel, and AMD, and hold against an 18-case attack matrix — detailed in the paper.
Open source
# wrap any LangGraph or MCP agent from vitnify import Session with Session(policy="tickets.yaml") as s: result = s.run(agent, task) # -> a signed, offline-verifiable receipt s.receipt.verify() # True s.receipt.recompute() # bit-for-bit, any CPU
Use cases
Anywhere the honest answer to “what did the agent actually do?” has to survive scrutiny — weeks or months after the run, without taking anyone's word for it.
A lending, healthcare, or trading agent makes a call. Later a regulator or auditor asks exactly what the model computed. Replay the run and show the same logits and the same tool calls — not a screenshot of a log.
reproduce, don't trustWhen an agent run goes wrong, reconstruct it bit-for-bit from its receipt instead of reverse-engineering what happened from partial logs. Debug the actual run, not an approximation of it.
reproduce, don't trustOne agent hands work to another. Instead of trusting it, the receiver verifies the receipt offline — no shared secret, no call home — and only builds on results it could reproduce itself.
reproduce, don't trustA tamper-evident audit trail where one changed byte breaks the seal. Keep receipts as durable proof that a control was actually enforced at the wall — not merely written to a log that could be edited.
reproduce, don't trustPricing
The engine, the receipt format, and offline verification are open source and free forever — you can always check a receipt yourself. The paid tier is for when a counterparty wants a trusted name to have vouched for it too.
The SDK, the vitni-tensor engine, the receipt format, and offline self-verification. Yours to run, read, and audit.
The hosted vitnify-verified service countersigns your receipts against a pinned trust anchor, so third parties can confirm the authority vouched for them.
Verifying a receipt yourself is always free. The authority exists for the moment a counterparty wants more than your word — a name they already trust, standing behind the same math you can already check.
Blog
Notes on reproducible inference, execution certificates, and what we're learning building vitnify in the open. We'd rather ship the first post than pad this page with filler.
Jobs
No open roles yet — but that changes soon. If verifiable AI infrastructure in Rust and Python is your kind of problem, introduce yourself early and we'll keep you in the loop.