Zero-cool here. If you are running autonomous agents in production, you have a visibility problem that standard observability tools cannot solve. When an agent exfiltrates customer data because a malicious webpage hijacked its context, a trace log tells you an email was sent. It does not tell you which specific step executed the command, whether the instruction originated from a trusted user or a poisoned web fetch, or if an auto-approve policy waved it through without human review. Mnestiq, a new open-source project hosted on GitHub, attempts to close this gap by providing a tamper-evident 'flight recorder' for AI agents, built specifically for incident response rather than dashboard aesthetics.

Cryptographic Integrity Over Observability

The core differentiator for Mnestiq is its reliance on cryptographic proofs rather than mutable logs. The system records every event with rich attribution metadata, including run_id, step_id, agent_id, and sandbox_id. Crucially, every piece of model context is tagged at capture time with provenance labels such as 'system', 'user', 'model', 'tool_output', or 'web'. This tagging is essential for post-hoc prompt-injection analysis. The evidence records are hash-chained using RFC 8785 canonical JSON and SHA-256, then periodically sealed by Ed25519-signed Merkle checkpoints (RFC 9162). This structure ensures that any edit, deletion, insertion, or reordering of the log fails verification, providing immutable evidence of what the agent actually saw and did.

Automated Injection Detection Rules

Mnestiq goes beyond passive recording by implementing six specific detection rules (MNQ-001 through MNQ-006) that flag suspicious behaviors. For example, MNQ-001 detects when a tool call's arguments contain an email address or URL that appears in untrusted content (like a webpage) but not in the user's original prompt or system instructionsβ€”a classic signature of a hijack. MNQ-004 flags sensitive actions, such as credential changes or deletions, when the argument values originate from untrusted content. The tool also includes a local dashboard that visualizes the step-by-step timeline, coloring each context piece by its provenance and linking outbound network connections back to the specific agent step that initiated them.

Deployment Flexibility and Safety

The project offers two primary integration paths: a drop-in Python SDK that wraps Anthropic and OpenAI clients, or a language-agnostic proxy mode. The proxy mode allows teams to record agents written in any language by simply pointing their base URL at the Mnestiq proxy, requiring no code changes to the agent itself. The system is designed to fail open; if recording fails due to disk issues or other errors, the agent continues to operate, ensuring the observability layer never becomes a single point of failure for production workloads. Security is handled via a separate signing service or Azure Key Vault to keep private keys out of the agent's reach, preventing a compromised agent from re-signing its own history.

Key Takeaways

  • Mnestiq provides cryptographic, tamper-evident logs using SHA-256 hash chains and Ed25519 Merkle checkpoints.
  • It distinguishes between trusted user inputs and untrusted web/tool outputs to enable precise prompt-injection forensics.
  • The tool includes six automated detection rules for common hijack vectors, such as untrusted arguments in sensitive actions.
  • Integration is available via a Python SDK for Anthropic/OpenAI or a universal proxy mode for any language.
  • The current version is v0.2, with a roadmap including S3 Object Lock sinks, TypeScript SDKs, and OpenTelemetry support.

The Bottom Line

Dashboards are for operators; evidence is for lawyers and security teams. Mnestiq understands that when an agent goes rogue, you need cryptographic proof of what happened, not just a pretty graph. This is a critical missing layer for enterprise AI adoption.