Platform
Sealr keeps the register of what your AI agents do. A binary sitting in the execution path writes every operation into a hash-chained, signed evidence stream; deterministic guards return a verdict before execution; anyone can verify the result offline.
Architecture
Two functions only: record what agents execute, and constrain the most destructive operations before they leave. Everything else exists to make those two functions verifiable by a third party.
A Rust binary sitting in the execution path: MCP proxy over stdio and streamable HTTP, agent hooks, command-line wrapper. It decides locally, writes to disk, then syncs. No network dependency on the hot path, and a latency budget of 3 ms p99 in observe mode, 15 ms in enforce mode.
Learn more — RecorderThe evidence store: records hash-chained with BLAKE3, checkpoints signed with Ed25519, and an encrypted vault where policy allows payload capture. In the Hybrid model it runs inside your own infrastructure, on your Postgres and your object storage.
Learn more — LedgerThe control plane: authoring and publishing signed policies, OIDC SSO and roles, human approvals, evidence explorer, Exposure Report, audit export, Recorder fleet. It never receives anything beyond metadata, checkpoints, and Merkle roots.
Learn more — ConsoleThree guards in V1. SQL Guard reads the real PostgreSQL grammar: unbounded writes, destructive DDL. Terraform Guard counts deletes and replacements in the plan JSON. Git Guard sees force-push, protected branches, tag deletion. The verdict is returned locally: ALLOW, WARN, REQUIRE_APPROVAL, or BLOCK.
Learn more — Guard packsThe offline verifier, published under Apache-2.0. It recomputes the chain, the Merkle proofs, the signatures, and the timestamp tokens of an .seal bundle, and states what it can assert as plainly as what it cannot. Verification never calls our servers.
Learn more — sealr-verifyEU Cloud, or Hybrid/BYOC — the default for regulated organizations: the Ledger is deployed on your side via Helm chart, and only metadata crosses the boundary. The Sovereign-BYOC tier adds dedicated isolation for the most constrained contracts.
Learn more — Deployment modelsHow it works
One command, about thirty seconds: the Recorder takes its place in front of your MCP servers and agent hooks. Nothing to change in your agents' code, no verdict enforced. The first recorded operation lands in under five minutes.
After thirty days, Sealr produces an account written by your own traffic: your agents executed N operations, N were destructive against production, N would have required approval, N trace back to no human principal. Recording gaps appear with their bounds.
On the protected resources you designate, guards apply their verdicts and sensitive operations wait for a human approval, in the Console or in Slack. The verdict, the approval, and the mode change become signed records in their turn.
Interception surfaces
The Recorder requires no change to your agents' code: it inserts itself into the paths that already exist — MCP servers, agent hooks, command lines, CI jobs. The GitHub App fills in server-side coverage where no Recorder runs. Whatever passes through none of these points is not recorded: coverage is a property of your deployment.
Six interception surfaces in V1 — MCP stdio proxy, MCP streamable HTTP proxy, Claude Code hooks, CLI wrapper, GitHub App, Terraform CI step.
Security & sovereignty
We never see your payloads: the Console receives only structural metadata and cryptographic commitments, and literal values never enter it. The evidence is tamper-evident, not tamper-proof: it establishes the integrity, ordering, timing, and origin of the recorded stream, but it cannot prove that what was never recorded did not happen.
Thirty minutes with an engineer, on your own surfaces: the Recorder placed in observe mode, an evidence stream read end to end, an .seal bundle verified offline.