Let AI agents seal their own work (MCP, plugin + SDKs)

Agents act at machine speed: they write documents, make decisions, call tools, start sub-agents, produce artifacts. The organisations deploying them are starting to ask the obvious governance question — can the agent prove what it did? Sigill answers it in two complementary ways:

• Record every run. The Sigill plugin for Claude Code and OpenAI Codex, and the SDKs, seal each step of an agent run as it happens — before, during and after — so the run can be verified later, step by step and as a whole.
• Give the agent the tools. With Sigill's Model Context Protocol (MCP) server, any MCP-capable assistant can timestamp, seal and verify by hash, deliberately, as part of its work.

In both, content never leaves your machine: prompts, tool arguments, results and files are hashed locally, and Sigill receives digests only.

Record every Claude Code or Codex session: the Sigill plugin

In Claude Code, install the plugin and sign in once:

/plugin marketplace add sigill-ai/agent-plugins
/plugin install sigill@sigill
/sigill:connect

In OpenAI Codex, add the same marketplace, then review the plugin's hooks once (/hooks, press t — Codex runs a plugin's hooks only after you have reviewed them, again after each update) and ask Codex to connect to Sigill:

codex plugin marketplace add sigill-ai/agent-plugins
codex plugin add sigill@sigill

Signing in opens Sigill in your browser — no API key on the developer's machine. From then on every session is recorded as a verifiable agent run, with the same format and guarantees in both:

• Before: the control basis — your CLAUDE.md or AGENTS.md, settings and the recorder's control set — is sealed and timestamped before the agent acts.
• During: every tool call, tool result and model output is signed and chained to the one before it. Consequential tools (Bash, Write, Edit, MCP tools …) are sealed and timestamped before they run.
• After: the session's end is timestamped, which freezes the whole chain.
• Sub-agents: each sub-agent is a run of its own, bound to the session in both directions: the session declares it before it starts, and records its sealed result when it ends. A sub-agent left out of the evidence, swapped or edited afterwards is detected.

Organisations can enable it for everyone without a review step: through Claude Code's managed settings, or as managed hooks in Codex's requirements.toml. Sessions are sealed with the Sigill Platform Seal by default, or with your organisation's own certificate (SIGILL_CERTIFICATE_ID). Timestamps are standard RFC 3161; set SIGILL_QUALIFIED=1 for qualified (eIDAS) timestamps.

Record your own agents: the SDKs

For agents you build, the .NET and Python SDKs record the same open format (Agent Evidence Profiles v1). Start a run with its control basis, record each step, finish it — and start sub-agents as bound child runs:

var run = await client.StartAgentRunAsync(agent, options with { Delegating = true });
await run.RecordToolCallAsync("lookup_ticket", argsJson, operation: "read");

var delegation = await run.DelegateAsync("urn:example:agent:reviewer", instruction: taskBytes);
var child = await client.StartChildAgentRunAsync(reviewer, reviewerOptions, delegation);
// … the sub-agent records its own steps …
await child.FinishAsync("completed");

await run.CompleteDelegationAsync(child);
await run.FinishAsync("completed");

The Python SDK mirrors it (client.start_agent_run, run.delegate, client.start_child_agent_run, client.verify_agent_run_tree).

See and verify it

Recorded runs appear in Evidence as one entry per agent. Under it are its sessions, with sub-agent runs inside them; each run shows its control basis, its chain of steps and its closure. One click verifies a run — or a whole run tree: a tree is finalized only when every run in it is finalized and every link between parent and sub-agent holds in both directions. Export a run or a run tree and anyone can verify it offline at sigill.ai/verify-run, digests only.

What a verdict proves is stated next to it: that what was recorded is intact, in order and closed — not that every action an agent took was recorded.

Agent evidence has its own monthly quota on every plan, separate from document seals; a typical Claude Code session is 50–200 sealed steps.

Give agents the tools: MCP

Add Sigill to the agent's MCP configuration — for example in Claude Code:

claude mcp add --transport http sigill https://api.sigill.ai/mcp \
  --header "Authorization: Bearer YOUR_API_KEY"

In ChatGPT or Claude, add https://api.sigill.ai/mcp as a custom connector instead and sign in to Sigill when asked — no key needed; you approve exactly what the assistant may do, and can disconnect it any time under Settings → Connected apps.

The agent now has tools to timestamp hashes, create and verify detached seals (CAdES or JAdES) over hashes, seal multi-object AI-evidence records, look up prior proofs, and review your organisation's seal operations, certificates and quota. The MCP server has no document upload or download capability: the agent hashes files locally and sends only the digest, and gets back the timestamp token or detached signature to keep beside the file. For seals embedded in a PDF, put the SDKs in the agent's environment.

What it looks like in practice:

• "Timestamp every file you deliver" — the agent stamps each output's hash as it works, leaving .tsr tokens beside its deliverables.
• "Before using this file, check its timestamp" — the agent hashes the file it received and verifies it against the .tsr instead of trusting the bytes.
• "What did we seal last week?" — the agent queries the operation history and reconciles it against its own logs.
• "Seal the JSON report you just produced" — the agent hashes it, calls sigill_seal_hash with format: "jades", and saves the .jades.json beside the report.
• "Seal the contract draft you just wrote" — with the SDK available, the agent seals the PDF locally via delegated PAdES; only the digest reaches Sigill.

The MCP announcement post walks through a full session.

Recording and tools compose

Recording makes evidence the default: every step, whether or not the agent thought to seal it. MCP tools let the agent seal deliberately — a deliverable, a decision, a file it received. Use both: the run record shows what the agent did, and the seals it makes show what it produced.

Why this matters now

Agent output is exactly the evidence class that disputes will be made of: decisions with money attached, generated documents sent to counterparties, autonomous changes to systems. Evidence captured at the moment of action — hashed, timestamped, sealed — is categorically stronger than logs assembled after the fact, because it is independently verifiable and tamper-evident from the second it exists.