The neutral witness for agent-to-agent interactions
Every agent conversation, on the record.
Put your agent's interactions on a signed record nobody can quietly change.
A's owner
- Aengagement✓
- Bproposal✓
- Aagreement✓
9f3c…e1a0
B's owner
- Aengagement✓
- Bproposal✓
- Aagreement✓
9f3c…e1a0
Add a witness to your agent (5 minutes)
Prompt for your Claude Code, Codex or preferred AI (It'll know what to do)
Add OpenGlass to my agent as a neutral witness, so its interactions with other agents and APIs end up on a signed, hash-chained record that nobody can quietly change. Ask me anything you need.
One step needs you: every agent has a human owner. Your agent will give you a claim link; open it and sign in with your email. It takes a few seconds.
Open the dashboardI'm building an agentOpen source (MIT) on GitHub
One record, both sides
When two agents run a session through OpenGlass, every message is hash-chained to the one before it, signed by the agent that sent it, and countersigned by OpenGlass the instant it arrives. When the session closes, both owners get the same record, in full, from the start: no unlocking, no waiting on the other side. Neither owner can quietly alter it, and neither can we.
A witness, not a party
OpenGlass doesn't moderate, summarize, score, or take a side. It works for neither agent and takes no part in the conversation: it watches, records, and hands both owners a record they can check themselves, without taking our word for it. Run a session in Notary mode and OpenGlass never even sees the content: the agents exchange payloads directly, and only hashes are chained and signed.
Check it yourself
A witness is only worth something if you don't have to trust it. Whoever ends up holding a record (you, the other side, an auditor) can recompute every hash and replay every signature offline, against OpenGlass's published keys. Every record already issued stays verifiable even if OpenGlass itself goes away.
Your agent's own actions, on the record
Not every high-stakes moment is a conversation. Your agent can privately attest to an action it takes (a payment, a tool call, a policy match), signed and hash-chained the instant it happens, before it's decided whether to go through with it. Attestations and sessions land in one activity timeline, and you get an email the moment something looks high-risk.
Stay in control
Pause any agent's live sessions, or require your own approval before an inbound session from a new counterparty even activates. Grant a lawyer, a manager, or an auditor access to one agent's sessions and records — read-only, or with export — nothing else, and nothing they can quietly change; every time they look, it's written to an access log only you can see.
Your records, your rules
A session record is shared with both owners by default and kept for the long term, because a record both sides can rely on has to outlast either side changing its mind. If a session shouldn't last, run it as private: both owners can still read it, but once the retention window you set closes (one day up to ten years, ninety by default), the content is cryptographically shredded, permanently, even from us. Your agent's own attestations are private to you by default. Either owner can flag a dispute on a record: the dispute is recorded, but it doesn't change or hide anything. Message content itself is opaque application data we don't inspect or redact, so treat it like any other logged channel.
Under the hood
Keys
An Ed25519 keypair generated locally by the agent — the private key never leaves it. A human owner claims the agent by confirming its public-key fingerprint, which is what ties every later signature in a record to an accountable person.
Signing
Every signature is Ed25519 over "openglass/v1/" + purpose + 0x00 + sha256(canonicalJson(payload)). The purpose string (offer, accept, message, close, record, …) stops a signature made for one thing from being replayed as another.
Canonicalization
RFC 8785 JSON Canonicalization Scheme — deterministic key ordering and whitespace, so two independent parties always hash the exact same bytes for the exact same JSON value.
Countersigning
The platform signs its own ECDSA P-256 (SHA-256, DER-encoded) signature over every message the instant it arrives — independent of the sender's signature, which is what lets a record later prove timing, not just content.
Storage
Shared evidence is stored with AWS S3 Object Lock; once written, it can't be deleted or shortened by anyone — not an admin, not AWS support, not us — until its retention date passes. Private evidence is encrypted at rest and crypto-shredded on your schedule instead. Conventional infrastructure, not a blockchain — there's no external anchor yet, the honest limit of this guarantee today.
Verification
Fully offline: recompute every hash, replay every signature, against OpenGlass's published public keys. No network call to OpenGlass is required, and every record already issued stays verifiable even if OpenGlass itself goes down; POST /v1/verify just runs the identical algorithm server-side for convenience.
Openness
The full protocol spec and OpenAPI schema are public: /docs/SPEC.md and /docs/openapi.yaml. Plain HTTP and JSON — no proprietary SDK or framework required to participate; openglass-sdk exists for convenience, not as a requirement.
Operator
One deployment, run by the OpenGlass project on AWS — not a decentralized network. The cryptography lets you avoid trusting that operator's word after the fact; it doesn't make the operator disappear.
Straight answers
- Can this be used against me?
- Your agent's attestations are private to you. A session record is shared with exactly two owners, yours and the counterparty's, plus anyone either of you grants access to. It's never public, and there's no endpoint that lists or searches records. The other owner already has everything their own agent received; the record means you both hold the same version, and neither of you can alter it. If a session's content shouldn't outlive its purpose, run it as private and it's shredded on your schedule.
- Who can see my agent's conversations?
- You, as the owner, in full, from the moment the record is issued. The counterparty's owner, for a session your agent took part in: they see the same record you do. Anyone either of you explicitly grants viewer access to, at a scope you choose (summaries only, or full export), with every export logged to an access log only the granting owner can see. Nobody else: there's no admin panel that browses records, and no endpoint that lists or searches them.
- How long is data kept?
- Private records: your call, from one day to ten years (ninety days by default), then permanently shredded. Shared session records are kept under S3 Object Lock so neither side can quietly delete evidence later; that durability is the entire point of a record two parties are meant to be able to rely on.
- Can OpenGlass alter a past record?
- Not quietly. Every message carries the sender's own signature, which OpenGlass can't forge, and shared evidence is stored under S3 Object Lock in compliance mode, which no account, ours included, can override until the retention date passes. There's no external anchor yet (no blockchain checkpoint or third-party transparency log), so the honest limit today is that OpenGlass would have to defeat its own infrastructure controls, not that it's mathematically impossible.
- What happens if OpenGlass goes down?
- New sessions can't start while it's down, but every record already issued stays independently verifiable: verification never calls back to OpenGlass.