Your AI agent said “done.” It lied.
One decorator gives every agent action a receipt it can't forge and a gate it can't cross. Open-source, framework-agnostic, 30 seconds to first trace.
208 on the waitlist
Your agent said “done.” Did it?
Receipt, gate, and evals. The trust boundary, in one place.
Everyone watches agents. We prove and stop them.
Observability is table stakes. The gap is control: proving what happened and stopping what shouldn't have.
Detects after the fact, proposes fixes
Stops the irreversible before it runs
LLM-inferred "semantic failure" detection
Deterministic receipt + graph walk root cause
Closed-source SaaS
Apache 2.0 + OTEL + self-host in two containers
Detection + code-fix suggestions
Hash-chain audit + EU AI Act Article 12 export
Prove it, stop it,
understand it.
The receipt and the gate are the wedge. Around them sit root cause, a free kill-switch, OTEL tracing, and compliance-grade audit. Every piece reads and writes one action record.
Did it actually work?
Per-run verdict with claimed vs. actual diff. Silent failures hit Slack.
Stop before the irreversible.
Deterministic block before deletes, payments, and deploys. Human approves.
why(), not an LLM guess.
Deterministic graph walk to the step that diverged. No model call.
Agents spend money while you sleep.
Budget, loop, and token caps. Hard stop per run. Free.
OTEL-native, no lock-in.
Every span, tool call, token, and cost. Emits and ingests OTEL.
Evidence as a query.
SHA-256 hash-chained log. Article 12 export in one command.
One line in.
A receipt out.
Your first receipt in under 30 seconds. Add a gate, root cause, or a budget cap later. One line each.
Install
Open-source SDK, Apache 2.0. Self-host or use managed Cloud.
Get a receipt
Add @at.check. Every call gets a verdict. Silent failures ping Slack.
Gate the risky calls
Wrap with @at.approve. They pause until a human approves.
Self-host or Cloud
Two containers or managed Cloud. Your data, your choice.
Built for production from day one.
Tamper-evident by default. EU AI Act evidence a single command away.
Tamper-evident audit
SHA-256 hash-chained log. Append-only and verifiable.
PII redaction, SDK-side
Sensitive data stripped inside the SDK before export.
SSO, RBAC, self-hosting
Full on-prem deployment. Two containers, free forever.
Article 12 export
One-command signed evidence bundle. Budget window is now.
Questions, answered
The trust boundary, how it compares, and what we're building.
What does Agenko actually do?
Every consequential action gets two things. A receipt after it runs proves what the agent actually did versus what it claimed, with a verdict: grounded, ungrounded, or silent failure. A gate before it runs holds any irreversible action for human approval. Around both sit tracing, a free cost and loop kill-switch, deterministic root cause, and a compliance-grade audit export.
Is it available?
Not yet. The SDK and platform are in active development. The spec and strategy are on GitHub, but nothing is released today. Join the waitlist for early access at launch.
How is this different from Langfuse, LangSmith, or Braintrust?
Those platforms watch agents. They store spans (Langfuse, now owned by ClickHouse) or sell eval scores from a proprietary database (Braintrust), and LangSmith is coupled to LangChain. None of them lead with ‘your agent said done and it lied, here is the proof,’ and none put a deterministic approval gate in the execution path. Agenko is open, OTEL-native, framework-agnostic, and boundary-first.
How does this compare to Lemma?
Lemma (YC F25, $2.3M pre-seed) detects silent failures and auto-fixes prompts. That's useful. But Lemma is closed-source, doesn't put a gate in the execution path, and doesn't produce a tamper-evident audit trail. Agenko is open-source, stops irreversible actions before they run, and chains every action record with SHA-256 hashes for compliance-grade proof. Same problem, different weapon: Lemma fixes after the fact, we prevent and prove.
How does this compare to other detection tools?
Detection tools watch agents and propose fixes after the fact. Agenko puts a deterministic block in the execution path before irreversible actions run, with a tamper-evident audit trail. We detect, stop, and prove. Same pain, sharper weapon.
Will it be open source?
Yes. The core is Apache 2.0 and self-hostable in two containers, the app plus Postgres, with OTLP out to Datadog, Honeycomb, or any backend. Managed Cloud is optional for teams that would rather not run infra. Self-host is free forever, and we monetize Cloud and Enterprise support, never crippleware.
Are the verdicts real measurements or guesses?
Both, and we label which is which. Hard facts, like whether a tool was called and with what arguments, are measured. Signals that infer rather than measure, like grounding scores, carry an estimated badge and a documented method. We never sell a heuristic as a measurement, and root cause is a deterministic graph walk over the trace, not an LLM guess.
What is the developer experience goal?
Dead simple. Call init() with no required arguments, let it auto-detect your frameworks, and your first receipt lands in under 30 seconds. The gate, root cause, and budget guards are one extra line each, only when you need them.