THE INSTRUMENT · APACHE-2.0
Witness is the recorder a Flight Check runs on: a transparent MCP proxy that writes a tamper-evident record of every tool call your agents make. It is open source, so you can read it line by line before it executes in your environment. This page is what it does and what it deliberately does not do — then the source.
WHAT IT IS
Observability tools start after the model is called. Identity tools stop before the agent acts. The question every incident review asks sits in between: what did the agent do, and can you prove it? Witness answers the narrowest useful version of that — per call, at the MCP boundary, with a chain that detects edits.
STDIO PROXY
Claude Code, Claude Desktop, Cursor, Cowork or your own harness on one side; any stdio MCP server on the other. JSON-RPC frames relay through untouched. On the way past, each tool call and its result are digested into an append-only log.
HTTP / SSE
A loopback reverse proxy for Streamable HTTP and SSE servers. Bodies relay byte-for-byte. The Authorization header passes through and is never recorded. An unreachable upstream answers a JSON-RPC 502 and the call seals as unknown rather than vanishing.
WRAP
Auto-detects project .mcp.json, ~/.claude.json, Cursor's mcp.json and Claude Desktop. Reversible, idempotent, dry-runnable, and it keeps a backup. Uninstalling is restoring that backup.
CHAIN
Each entry carries the SHA-256 of its predecessor. Editing any record in the middle breaks every hash after it, and verify walks the chain and exits non-zero on the first broken link.
REDACTION
Keys matching token, secret, password, authorization, cookie, api_key or credential never reach a summary — even when someone explicitly allow-lists them. Arguments and results are stored as digests, not content.
READING
tail follows a live session; sessions lists them; query filters by tool, server, principal, status or time; report produces a markdown digest with error rate and p50/p95 latency per tool; anchor appends chain heads to a checkpoints file that is itself chained.
THE TWO RULES
Two constraints govern every decision in the recorder. They are the reason it is useful in an audit and the reason it is safe to leave running.
A call the server never answered is recorded as unknown, not omitted. Scope that was not observed is declared as unobserved. An empty log is a question, not a clean bill of health — a lesson we learned on our own estate.
Nothing in the recording path may delay, alter or drop a frame. If the recorder cannot write its log it says so on stderr and keeps relaying. Recording can be lost; uptime cannot.
WHAT IT DOES NOT CLAIM
A security tool that oversells itself is worse than no tool, because it buys confidence it has not earned. These are the things Witness cannot do in this version, listed here rather than discovered by you in week two.
READ IT YOURSELF
Apache-2.0, zero runtime dependencies, one file you can read in an afternoon. Complete for one engineer, free, forever — the Flight Check is where an organisation buys the reading of it, not the tool.
TWO WEEKS · $7,500 · NOTHING LEAVES YOUR NETWORK
Run Witness yourself for nothing, for as long as you like. A Flight Check is what happens when someone who has read a few thousand of these records sits down with yours.