QED ProofProof of Agent Work on GitHubSign inStart freeEvery agent reports its own success. QED Proof reads the place the work was meant to land — the repository, the timeline, the ad account — and issues a signed receipt that holds up without trusting us.
Open protocol · self-hostable · every receipt anchored on Base Sepolia (testnet)
A short looping animation of how QED Proof turns a claim into a receipt. The six steps are described in words further down this page.
Reads the destination directly. Live means verified today.
Tracing tools record what the agent reported. Reputation systems record reviews and payments. When the push never happened, the post never went live or the budget never moved, the report still says success — and somebody finds out days later, if at all.
The only thing that settles it is the destination's own record.
“Pushed a1b2c3 to main.”
main's commit list has no a1b2c3.
“The deploy is live and answering.”
The URL answers 200. It matches.
“Published the launch post at 09:02.”
The account's own timeline stops at 08:14.
All three reported success. Only one was telling the truth.
Six stages, in this order, every time. The rule that shapes all of them:
The evidence comes from the destination, never from the agent that made the claim.
“I pushed a1b2c3 to main.” From an SDK call, an MCP tool or a Claude Code hook. It is untrusted from the moment it lands.
Not the agent's log, not its trace — GitHub's own commit list, over read-only access you grant and can revoke.
Verified, Failed, Mismatch, Late, or Couldn't check. A verifier that times out or loses permission gives Couldn't check. It can never give Verified.
Ed25519, over the canonical bytes. The receipt carries the evidence, not the content it came from.
Each receipt is a leaf in a Merkle tree. Nothing already in the log can be edited or quietly dropped.
The log's root is published on-chain through EAS, on Base Sepolia (testnet) today. After that, not even we can backdate a receipt.
A receipt carries three proofs and nothing else it doesn't need: an Ed25519 signature over its canonical bytes, its position in the append-only log, and the on-chain anchor that fixes the log in time. It records fingerprints, never the content it read.
All three check independently. The verifier is open source and talks to a public Base RPC, so the person you send a receipt to needs no QED Proof account, no QED Proof API, and no reason to take our word for anything.
$ uv run spec/tools/check.py receipt.json poaw-keys.json \ --rpc https://sepolia.base.orgsignature ✓inclusion ✓ leaf 8 of 9anchor ✓ block 47,309,207trust level 2 proven by 21:38:22Summarised. check.py prints the full result as JSON.
“Which of last night's runs actually landed?”
The claims list, filtered to everything that didn't verify.
A marketing agent that posts and moves ad budgets, a coding agent that pushes, an ops agent that deploys — each one reports its own success.
“What broke, and is it still broken?”
One verdict, the destination's own words for why, and the one thing to fix.
They were doing something else ninety seconds ago. The page has to answer before it explains.
“What do I POST, and what comes back?”
An API key, a claim payload, and a receipt with a reason code you can branch on.
A verifier that errors returns Couldn't check, never Verified. That is the contract, not a caveat.
“Why would I believe any of this?”
The signature, the inclusion proof and the anchor — checked in your own browser.
They have no account and no reason to trust us. The proof has to hold anyway.
Written the way the product works: a destination is either being verified now, or connectable while its verifier is built. Anything not started yet stays off this list.
Proving that an agent pushed a commit won't keep anyone up at night. Proving that it changed an ad budget will. A pipeline is a rule you write once, in a form or in JSON, that says exactly which actions deserve a receipt.
Facts still come only from the destination, and your conditions can narrow a verified, never create one. The rule itself is hashed into the receipt, so whoever holds it can see precisely what was checked.
A marketer's pipeline, part by part
And the case plain logging never catches: a budget change the agent didn't report. Watch mode reads the account's own change history, matches it against open claims, and anything left over is an unclaimed change.
A verifier nobody can inspect is just another claim. QED Proof's spec, verifiers, node and checker are public, and you can run the whole thing yourself. There's no token — the chain only timestamps the log.
Read the protocol on GitHubConnect a repository, send one claim, read the receipt. Questions go to our Discord.