Know what your agent was allowed to do, what it saw, and what it did. Proveno enforces your policy on every tool call, records a trace that replays exactly, and proves the execution. Attestation from the sources you already trust plugs in on top.
Drops in as an MCP server. Point your agent at one endpoint, keep the tools you already run.
Our mission: make every agent action something you can check, not something you have to trust.
When something goes wrong, or a counterparty needs to rely on the result, "the agent said so" is not enough. You need to know what it was permitted to do, what data it acted on, and exactly what it computed. And you need someone other than the operator to be able to check.
Most tools answer one of these. Proveno ties all three into a single record you can replay or prove.
Every tool call is checked against a policy you define: which tools, which arguments, what limits. Credentials are injected at the gateway and never reach the model. The record commits to the exact policy that applied, and refusals are recorded too.
Plug in the attestation source you already trust. Proveno binds it to the exact bytes the program consumed, so the inputs cannot be quietly swapped. The provider vouches for the data; proveno makes it part of the proof.
Pluggable · first providers in progressThis exact program ran over these exact inputs and produced this exact output. Replay it bit-for-bit with the network switched off, or verify a zero-knowledge proof of the execution without rerunning it.
Not everyone, and not on day one. It depends on who has to rely on what your agent did.
The value is policy, sandboxing and replay: the agent cannot exceed its policy, credentials never reach the model, and every run can be replayed exactly for review. No cryptography required, and it works today.
A customer, an auditor, a regulator or a counterparty. A signed log asks them to trust you. A zero-knowledge proof lets them check the execution themselves, without trusting your infrastructure or rerunning your systems.
Proving gateway runs: on the roadmapProveno runs as an MCP server. Your agent connects to it like any other MCP server, and proveno connects to the MCP servers you already run. No SDK, no changes to your tools or your agent framework, in an existing pipeline or a new one.
Any MCP client that speaks streamable HTTP. One URL and one token per agent.
stdio or HTTP. Credentials stay with proveno and are injected per call, so the model never holds them.
Which tools each agent may call and the limits on their arguments. A few lines of TOML.
The agent writes a few lines of Lua against a typed API, so a fast, low-cost model is enough. In our conformance tests Claude Haiku wrote a correct program first time in 12 of 12 runs across three tasks, using under 4,000 tokens per program.
Your agent sees one tool, execute, whose description teaches the model exactly the API its policy allows.
# gateway.toml [[downstream]] name = "erp" transport = "stdio" command = "erp-mcp" credential = "env:ERP_TOKEN" [[downstream]] name = "bank" transport = "http" url = "https://bank.internal/mcp" credential = "env:BANK_KEY" [principals.finance-agent] token = "env:AGENT_TOKEN" # policy.toml [principals.finance-agent] allow = ["erp.get_invoice", "bank.pay"] [constraints."bank.pay"] amount_max = 5000 # your agent: one MCP server https://proveno.internal/mcp
Instead of letting a model call tools one at a time, the agent writes a small program. That program runs in a deterministic, sandboxed, metered VM, which is what makes it possible to replay and to prove.
Plain Lua, against a typed API generated from what its policy allows.
Arguments and limits are enforced before dispatch. The gateway holds the credentials.
Each response is recorded, and an attestation from your provider can be bound to it.
A signed trace reproduces the run exactly. A zero-knowledge proof lets someone else check the execution without rerunning it.
-- written by the agent local inv = erp.get_invoice{ id = "INV-1042" } if inv.status ~= "approved" then return { action = "hold" } end local ok, res = pcall(function() return bank.pay{ invoice = inv.id, amount = inv.total } end) # policy.toml [constraints."bank.pay"] amount_max = 5000 denied_by_policy bank.pay amount 7200 # refused before dispatch, recorded in the signed trace $ proveno-gateway replay replay matched output, gas_used, memory_used
Payments, operations, internal tools, anything with credentials behind it.
Settling results in smart contracts is on our roadmap for later.
Agent tasks are small. Proveno proves its own interpreter running inside the OpenVM zkVM, so cost tracks the work a program actually does and short programs prove on ordinary hardware.
Read the trust model for every known failure mode.
Design partners, investors and curious builders. Tell us what you are working on and we will get back to you.