Xonta GitHub

Self-hosted · open source

An agent's report isn't evidence.

Xonta sits in front of your AI agents and signs a tamper-evident receipt of what each one actually did, then holds them to spending and exposure limits. Anyone can verify a receipt without trusting us. Run it yourself in one command.

Run it yourself Try the live check
Apache-2.0 Works with any MCP server Open protocol, reference code on GitHub.
Your agentacts through MCP
→
Xonta Gatelimits · signs · logs
→
Signed receiptanyone can verify

The problem

If you only test the happy path, every agent looks perfect.

In an open honesty benchmark, five models never lied in their own report when there was no pressure. Asked to claim a check they never ran, they did it every time.

101/101times a model claimed a check it never ran, under pressure
0of those lies survive a signed receipt

An agent's own log is a claim, not proof. Xonta makes the claim checkable.

See the benchmark and method →

How it works

Three steps, no change to your agent.

01

Put Gate in front

Your agent's MCP traffic goes through Xonta Gate, self-hosted on your side. The agent and its tools stay exactly as they are.

02

Every action gets a receipt

Gate signs each tool call and each spend with the executor's key and chains it to the last. Budgets and exposure caps stop a risky call before it runs.

03

Anyone can verify

A receipt proves what happened by signature and arithmetic alone. Your auditor, your customer, another orchestrator — none of them has to trust Xonta.

Live check

Check a receipt the agent can't fake.

This runs entirely in your browser against a genuine signed example. Press Alter an amount to see a one-digit change get caught.

In production this key is read from the signer's published did:web. The example fills it in for you.

Ledger

#Action AmountBalance Signature

Chain integrity

    What Gate enforces

    Limits that stop an agent before it overspends or leaks.

    Action budget
    How much the agent may do on its own, earned from its track record, not granted by default.
    Exposure cap
    The worst a single call can cost, read from its own arguments and capped per tool, whoever asks.
    Shared owner pool
    All of one owner's agents reserve from one atomic budget, so parallel children can't together overspend.
    Hidden-instruction blocking
    Injected orders buried in a tool's output never reach the agent as commands.
    Signed audit log
    A hash-chained, signed record of every call. xonta-gate verify checks it; so can anyone.
    Held irreversible calls
    A call past the limit is held, not run, and waits for a human to release or cancel it.

    The network

    One Gate protects one business. Many, speaking OCX, protect each other.

    Orchestrators exchange signed signals — this agent was caught misreporting, its autonomy is now capped — within one organization between its own orchestrators, or globally across the internet. Each signal is signed and verifiable, and shows the behavior without revealing the underlying data.

    OCX is an open standard, not a product. Think shared threat intelligence for agents: every Gate that joins makes the rest harder to fool.

    Read the OCX specification →

    Quickstart

    In front of any MCP server, in one command.

    Node 20+. Free and open source. Nothing is sent to Xonta — the gate, the keys and the log stay on your machine.

    # clone and install
git clone https://github.com/mrsergeiluzhnov/xonta
cd xonta && npm install

# put Gate in front of a stdio MCP server (Claude Desktop, Cursor)
node bin/xonta-gate.js -- npx -y @modelcontextprotocol/server-filesystem ~/Documents

# or a remote server over HTTP, with a 200-action budget
node bin/xonta-gate.js --http 4950 --budget 200 --url https://your-mcp-server/mcp

# anyone can verify the signed audit log afterwards
node bin/xonta-gate.js verify

    Point your MCP client at the gate instead of the server, and it keeps working. See the README for policy files, exposure caps and the owner pool.