The engine underneath

Your agent can move money, change records, and place trades. When an inspector asks who owned an irreversible call, your own log cannot vouch for itself.

MakerChecker is the independent referee and evidence standard for AI agents that take high-consequence actions, self-hosted and domain-neutral. The agent clears the routine work. The agent that proposes an irreversible action is refused as its own approver, a hard HTTP 403, and the call stops for a second, named human. Each decision commits to an Ed25519-signed, SHA-256 hash-chained log your own auditor recomputes offline, with no access to your systems. A company cannot issue its own financial audit, and an agent cannot self-certify: that independence is the moat, and it is what gets the agent into production.

Why this is the moat

We can't grade our own homework. That is the point.

Anyone can bolt on a tamper-proof log and a human sign-off. Those are table stakes. The one thing a builder cannot give itself is independence. We built the agent, so our word about it counts for nothing with an outside inspector. The proof has to be something they check without us.

A SOC 2 report only carries weight because the auditor has no stake in the result. The padlock in your browser only works because it rechecks the site against a public log instead of trusting the site. We bring that same shape to AI agents that take high-consequence actions. Anyone can copy our controls. No one can make themselves independent of themselves.

Complementary, not competing

Agent control-planes govern your fleet from the inside, with identity, policy, and observability. That is real and useful, and we sit on top of it, not against it. A control-plane is the operator's own view of its own agents. The MakerChecker record is what the operator hands an inspector who will not take their word for it.

One runs your agents. The other is proof someone outside can stand behind.

The mechanism underneath

The proof falls out of the work, not a report we write later.

These six controls are how the engine makes the proof real. The key one: the action and its record commit together, so an agent cannot act without leaving the evidence. The record is generated by the enforcement itself, not written up afterward by the party under scrutiny.

Nothing standing

Version-pinned skills

An agent can do nothing until a skill is granted to its role, and that grant is pinned to one version. What the agent can do is explicit, small, and easy to audit. Nothing is implicit.

Maker is not checker

Segregation of duties

The identity that proposed an action is blocked in code from approving it. The engine enforces this before the action runs, so it holds whether or not an SOP says so.

Fail closed

Limits and gates

Over budget, past a rate limit, or against a duty rule, the action is denied before the tool runs. High-risk decisions stop for a named, authenticated person who signs, with the reason recorded word for word.

One transaction

The action and its record commit together

The state change and its audit event land in a single database transaction. "Acted but did not log" cannot happen, because there is no path where one lands without the other.

Tamper-evident

Hash-chained, Ed25519-signed

Every step is appended to a signed, hash-chained record. Change one row and the chain breaks, and the check points at the altered line. The record is evidence anyone can recheck, so no one has to trust it.

No trust required

Checked offline, by anyone

The audit format is published and open. An auditor rebuilds the check from the spec, in any language, with us nowhere in the loop. You trust the proof because you can run it yourself.

AI agent

Proposes a consequential action

Take a consequential actionSubmit a filingAttest eligibilityClose a case

MakerChecker gate

Granted skill
Deny by default. Only the skills you grant, at your tier.
Independent sign-off
The proposer cannot approve. A second human signs off.
Signed audit
Proof
Every step written to a tamper-evident, signed record.

Refused

Ungranted skill or self-approval is blocked

Refused before it runs. Not flagged after.

Only then

The action runs

always written

Audit pack

Hash-chained, Ed25519-signed evidence

Regulator

Verifies it offline, with none of our code

Chain verified

Ed25519 · verified offline

Cross-framework, in your environment

We meet your agent where it runs. No migration.

Point the SDK at your own self-hosted instance, wrap the tools the agent calls, same names and same schemas, and ship. Nothing to re-platform. The agent keeps running where it runs today. A denied action stops before it fires, and the record is written as the action commits. Typed connectors ship for LangChain and the Claude Agent SDK. CrewAI, LlamaIndex, and AutoGen connect through the generic wrapper. It does not care which framework you chose.

import { createClient } from "@makerchecker/sdk";
import { governLangChainTool } from "@makerchecker/connector-langchain";

// Point at your own self-hosted MakerChecker. We never see your data.
const mc = createClient({ baseUrl: process.env.MAKERCHECKER_URL });
const { session } = await mc.proxy.openSession({ label: "run" });

// Wrap a tool your agent already has. Its name and schema do not change.
const act = governLangChainTool(
  mc,
  { sessionId: session.id, agentName: "agent", skillRef: "skill@1" },
  rawTool,
);

// The agent calls it normally. A denied action throws before the tool
// runs, and every call is signed into the audit chain.
await act.invoke({ input });

How MakerChecker attaches: typed connectors, the generic wrapper, proxy sessions and flow gates →

The work it clears

The agent clears the queue. The one call it cannot take back stays with a named human.

The engine is domain-neutral. It governs a wire transfer, a trade, a production database change, or a clinical decision the same way: the agent clears the routine work, and the one irreversible call stops for a named human, on a record an outsider can recompute offline. The workflows below are the healthcare vertical, the first one we built, and each ships in the open repo today, not a roadmap. Read the code before you trust the claim.

Patient access
Clears the benefits investigation
The agent runs the benefits investigation and clears the queue. Confirming eligibility, or routing a patient toward copay or foundation funding, stays a named access specialist's call, because in patient access the operator is the one a federal recovery lands on. It is sealed into a record an OIG reviewer can open and check without taking the operator's word for it. Built against the Anti-Kickback Statute and False Claims Act.
See the patient-access product →
Pharmacovigilance
Clears the adverse-event queue
The agent closes the routine adverse-event cases on its own. The seriousness and expectedness call, the one that starts the 15-day clock, waits for a named safety physician. P-4001 closes itself. The serious P-4003 waits for the doctor, on a record an inspector can open.
See the drug-safety page →
Medical devices
Clears the complaint queue
The agent triages the device-complaint queue. The call on whether a complaint starts the reporting clock, 30 days under 21 CFR Part 803 or as few as 2 under EU MDR Article 87, stays with a named regulatory-affairs reviewer, kept in the event file an examiner can check. Built against 21 CFR Part 803 and EU MDR.
See the life-sciences page →
Clinical trials
Screens the candidates
A screening agent reads the records and proposes who fits the trial. The eligibility determination stays the named investigator's call, on a record a monitor can open and check. Built against ICH-GCP E6.
See the life-sciences page →

Why truly open is the point

A proof you cannot read is just a vendor asking for trust.

Independence and a black box cannot coexist. If you have to take our word for what the engine does, you are back to trusting us, the one thing this is built to remove. So it is open source and self-hosted, so your security team can read every line. An AGPL-3.0 core and an Apache-2.0 SDK, not source-available with strings. Your team reads the engine, the connectors, and the check before anything touches a real action. Your security review runs against the code, not a datasheet.

The Apache SDK means you can ship the connectors inside a closed product of your own. It is self-hosted, runs inside your perimeter, air-gapped if you need it, on your own Postgres. It never phones home. The record an auditor checks is rebuildable from a published spec, with us nowhere in the loop.

Read the engine on GitHub See the proof

Core license: AGPL-3.0
SDK license: Apache-2.0
Runs on: Your infrastructure
Deployment: Self-hosted, air-gapped
Database: Your own Postgres
Phones home: Never

The independent referee and evidence standard for AI agents that take high-consequence actions · open source and self-hosted · runs on any framework, in your environment.

Clear a real case

Pick the casework. We clear it and prove who owned the call.

Tell us the high-consequence work you want an agent to actually do, not just suggest. We build the first agent with you, clear a real queue, and hand you the signed file your auditor checks themselves. You can read every line of the code before any of it touches a real action.

Start a paid casework pilot See it verified Read the engine on GitHub

Self-hosted, open source, designed against the rules your auditors already enforce.