Halo-record provides open-source AI agent

Developer Brian Kuan has written halo-record, a small open-source Python package. It creates an append-only, hash-chained audit log for AI agent actions like tool calls and data access, allowing independent verification without vendor permission.

Security teams can now test an agent's activity log themselves. The package wraps an agent with one line of Python and can pull records from existing tooling like OpenTelemetry, LangChain, or MCP servers. Raw arguments are never logged; values are hashed and redacted to protect secrets and personal data. With no runtime dependencies and roughly 5,300 lines of code, it is designed to run inside a vendor's own product.

The witness problem

A hash chain proves records were not altered after writing. It cannot prove that every record was written. An operator could delete records and re-seal the chain, leaving the file internally consistent but incomplete.

Closing this gap requires an external witness. This party would periodically store two numbers: the record count and the chain's head hash. A self-run witness only proves integrity to the operator, not the customer. Kuan intends to fund the work through a hosted witness service.

Vendor and market pressures

"Vendors volunteer because it closes deals," Kuan told Help Net Security. He argues that presenting a prospect with your own logs breaks the oldest rule in assurance. Independent verification is key, much like in a SOC 2 audit.

Adoption pressure is forming. Standards like AIUC-1 now require tamper-evident runtime logging. Insurers are starting to ask similar questions. The recent Hugging Face intrusion, run by an autonomous agent, highlighted the need. That agent performed roughly 17,600 actions over five days. Reconstructing events manually was impractical, and only some logs could be retrieved. A responder reading one action per minute would need twelve straight days to review the activity. Our stats on incident response times show why automated logging is critical.

An open format by design

Kuan controls the record format, but it is versioned, public, and simple to implement without permission. "If a big platform ships its own incompatible version, that mostly proves the point - the market agrees the evidence matters," he said. Any variant still faces the core question: can anyone besides the vendor verify it?

This tool does not provide certification. It gives assessors something checkable against requirements in frameworks like the EU AI Act or the Cloud Security Alliance's AARM model. For teams evaluating their squad of security tools, halo-record offers a new layer of transparency. The package is available for free on GitHub.