Every AI interaction is a chain of messages between agents. Rootz makes those messages signed, verifiable, and durable — so you can prove who said what, to which model, and got which answer, independent of the transport that carried it.
One primitive, two pillars: how humans talk to AI securely, and how AI talks to services securely.
Verify Signed MCP live → Talk to your LLM, own the answer → For AI agents (Markdown) →
The industry is building “AI in a box” — a perimeter around the model. The Five Eyes and the NSA are asking for something different: message integrity — signed, durable, non-repudiable. Rootz delivers it on both sides of every agent.
You sign your prompt at the source. A measured model answers. The output is bound to your prompt and returned as a signed receipt you own. Green light = verified; check-engine = proof failed.
DKIM for the Model Context Protocol. Every MCP response and tool definition carries a portable signature proving origin, integrity, and freshness — independent of transport. Crypto-agile + hybrid post-quantum.
result._metaAligned with the Five Eyes agentic-AI guidance, the NSA MCP Security notice, and Pope Leo XIV’s Magnifica Humanitas. · For machines: /ai.md · /ai.json
Two live demos, running on this server right now — one per pillar. No install, no login. Click in, watch the green light, then break it and watch it go red.
Chat with a real model. Your prompt is signed in your browser before it leaves; the answer returns cryptographically bound to it. You get a green light — click it for the full proof, then hit Tamper and watch it turn red.
Proves: who asked · which model answered · the answer is bound to your prompt · any alteration is caught.
Open the demo →Pull a freshly signed MCP response from this server and verify it — origin, integrity, freshness, including a post-quantum signature. Edit one character and it fails closed.
Proves: the response came from who it claims · unaltered · fresh · independent of transport.
Open the demo → or try it right here ↓Paste a prompt; the service hashes every part of the interaction — system prompt, each tool definition, your context docs, your prompt, the answer — Merkle-roots them and signs it. Verify, tamper, or reveal any part (prove a document was in scope without exposing it). Session-scoped, with a disposition the service runs on session end/drop: hold (recoverable) · email · write to your data wallet.
Open the manifest demo →TLS secures the wire, then evaporates. Gateways, registries, caches, proxies and agent frameworks strip it — so the bytes that reach the model carry no proof of who produced them or whether they were altered. Signed MCP makes the proof travel with the bytes: every MCP response and every tool definition carries a portable signature proving origin, integrity, and freshness, independent of transport.
Crypto-agile and hybrid post-quantum
(ed25519 · ecdsa-p256 · ml-dsa-65 / FIPS 204),
keys discovered DKIM-style from the issuing domain's
JWKS. Implements the NSA MCP Security notice
(U/OO/6030316-26) and Five Eyes agentic-AI guidance: nonce + bounded-window
timestamp, context binding, and signed tool definitions to stop tool-poisoning.
Read the full Signed MCP page →
· Public verification keys (JWKS)
· GET /sign-demo POST /verify
You sign your prompt; a measured model answers; the output is bound to your prompt and owned by you. The same message-integrity primitive as Signed MCP, applied to the human–to–AI direction — and the guidance below maps to what we already run.
The joint guidance from CISA, NSA, UK NCSC, Australia ASD, Canada CCCS, and New Zealand NCSC specifies requirements for AI agent security. Every requirement maps to something we’ve already built and deployed.
| Five Eyes Requires | Rootz Implementation | Status |
|---|---|---|
| Cryptographically verified identity | Birth certificate on Polygon. secp256k1 ECDSA. TPM-bound keys. | Live |
| Short-lived credentials, JIT provisioned | Session tokens (5-60 min TTL). Desktop V6 issues and revokes. | Live |
| Zero trust between agents | Every MCP call policy-checked. No implicit trust from co-membership. | Live |
| Replace persistent API keys | Wallet-based OAuth (epistery challenge/sign/verify). No bearer tokens. | Live |
| Encrypt inter-agent communications | ECDH + AES-256-GCM. Post-quantum: ML-KEM-1024 + ML-DSA-65. | Live + PQ |
| Attestation-backed tokens | TPM-bound key derivation. Hardware root of trust. Desktop as HSM. | Live |
| Agent identity lifecycle | Provisioning at spawn, scope binding, revalidation, automatic revocation. | Live |
The gap everyone else has: the Five Eyes guidance says agents need cryptographic identity, but their answer to “where does the root key live?” is “the infrastructure gives you one” (SPIFFE issuer, cloud IAM, vault). That creates a central policy engine as a single point of failure. Our answer: the key lives in the owner’s hardware (TPM). No central issuer. No infrastructure dependency. Sovereign.
Sources: CISA resource page • Full guidance • NSA press release • CyberScoop coverage • CSA analysis
Filed: September 27, 2024 — 19 months before the Five Eyes guidance.
Published: April 3, 2025. Allowed: June 3, 2026 (Notice of Allowance).
Inventors: Michael Sprague, Steven Sprague. Assignee: Sproquet Corp (Rootz-licensed).
Title: System to Assure a Response from an Identified, Measured and Verified AI.
View on Google Patents →
| Patent Claim | Implementation |
|---|---|
| Claim 1: Client signs request → assurance system validates → binds identity + assurance into response | Agent signs prompt hash via Desktop V6 (TPM). MCP Policy Router validates. Response hash-linked into chain. |
| Claim 2: DAPP + smart contract + blockchain wallet provides signing key; hash recorded on-chain | Sovereign Secret on Polygon. V7 contracts. Wallet-derived signing. Merkle root settled on-chain. |
| Claims 33-37: Local trusted hardware (TPM, TEE/TrustZone, Intel ME/vPro) holds private keys and validates signatures; trusted display for consent | Desktop V6 with Windows TPM. Key never leaves hardware. Agent gets session token, not key. |
| Claim 6: Blockchain records hash of every boot/loading step | Birth certificate (Note 0) + skill loading (Note 1) + session events → Merkle chain. |
| Claim 10: Aggregates integrity measurements; binds with signed envelope | Settlement Merkle root covers all events across all services. One hash proves everything. |
| Claim 13: Zero-trust controls verified, signed, and bound into the response | Every MCP call is policy-checked; zero-trust control results are signed and hash-linked into the session record. |
| Claim 15: Third-party security-control logs aggregated into a single signed manifest bound into the response | External control/audit logs are collected, signed, and combined into one manifest hash recorded with the session. |
| Claims 29-30: Encrypted request/response using registered key pairs | ECDH + AES-256-GCM. Post-quantum: ML-KEM-1024. Only agent and owner can decrypt. |
The insight: You don’t need to own the AI. You need to own the trust wrapper around any AI. The “data assurance computing system” (the patent’s term) is the MCP Policy Router. It wraps Claude, GPT, Gemini — whatever. Identity, measurement, and assurance happen in YOUR layer.
Regulatory data must remain verifiable for decades. Classical cryptography won’t survive that timeline. We built post-quantum encryption into the data wallet from the start — not as a future upgrade, but as a shipping feature.
| Capability | Algorithm | Standard |
|---|---|---|
| Key Encapsulation | ML-KEM-1024 (FIPS 203) | CNSA 2.0 mandated for data-at-rest |
| Digital Signatures | ML-DSA-65 (FIPS 204) | Dilithium — NIST PQ standard |
| Merkle Tree | PQ Merkle with ML-DSA-65 signed blocks | RFC 6962 domain separation |
| Key Rotation | 90-day epoch rotation with key chain recovery | Forward secrecy by design |
| Backup | Shamir 3-of-5 secret sharing over GF(2&sup8;) | Master seed recovery |
| Settlement | Dual-chain: Polygon (ECDSA) + Naoris (Dilithium-5) | Classical + PQ anchoring |
| Platform | PQ Encryption | PQ Signing | PQ Time | Level |
|---|---|---|---|---|
| Signal PQXDH | Yes | No | No | 2 |
| Apple PQ3 (iMessage) | Yes | No | No | 3 |
| Rootz PQ Wallet | Yes (ML-KEM-1024) | Yes (ML-DSA-65) | Yes (PQ Merkle epochs) | 4 |
11 TypeScript modules. 30 tests passing. Built on
@noble/post-quantum v0.6.0 (MIT, Paul Miller).
CNSA 2.0 compliant. Algorithm-agile — the wallet carries the algorithm,
not the protocol.
Three documents published within 30 days of each other. Three independent authorities. The same conclusion.
Pope Leo XIV, Magnifica Humanitas (May 15, 2026) —
The first papal encyclical on AI. 245 paragraphs on safeguarding human dignity.
“Disarm AI” — not reject, but free from monopolistic control.
Accountability requires verifiable identity. Subsidiarity means the owner holds the key.
Presented alongside Anthropic co-founder Daniela Amodei.
Read the encyclical →
Five Eyes, “Careful Adoption of Agentic AI Services” (April 30, 2026) —
First joint guidance from CISA, NSA, and all Five Eyes agencies on AI agent security.
Cryptographic identity. Attestation-backed tokens. Zero trust. Encrypted communications.
The first AI manufacturing quality checklist.
Read the guidance →
US Patent Application 2025/0112783 (filed September 27, 2024; allowed June 3, 2026) —
“System to Assure a Response from an Identified, Measured and Verified AI.”
Filed 19 months before the Five Eyes published the problem.
TEE/TPM-rooted identity. Blockchain settlement. Owner-controlled policy. Running in production.
View on Google Patents →
When the Church and the State are both discussing the future of AI, it is time to move. The Pope provides the principles. The Five Eyes provides the requirements. The patent provides the architecture. The code provides the proof. Three walls. One Jerusalem. Each builder chose their section.
Everything we build starts with one concept: give the data a contract. Not data stored on a blockchain — data wrapped in a smart contract that governs who can read it, who can write to it, and what the rules are. An encrypted envelope with a chain of signed evidence.
Data with a chain, not data on a chain.
The agent’s identity, its birth certificate, its action history, and its policy — all Notes on a single wallet. The agent IS the wallet. Recoverable from one address. Portable across hardware.
Every conversation, every workflow, every multi-step interaction — a wallet that accumulates signed messages. Watch the address and you see everything that happened.
The execution environment has its own identity — attestation history, loaded skills, policy configuration. The TEE proves its own integrity through its wallet.
This is the same technology that powers the AI Discovery Standard — how organizations publish signed, structured data so AI can understand them. The discovery layer feeds verified data INTO the agent. The agent’s wallet records what it did WITH that data. As the discovery ecosystem grows, agents have richer verified sources — and the provenance chain becomes exponentially more valuable.
For decades the engineering notebook was the gold standard of provenance: dated, witnessed, the durable record of when an idea was first conceived. Every patent, every design review, every audit trail began there. In the age of AI, that notebook has evaporated — your thinking scattered across model providers, summarized into “memory” features you don’t control, gone the day you switch platforms.
The PC can give it back. As you work alongside AI — thinking, designing, deciding, creating — the device captures it: every exchange, signed and timestamped at the moment it happens, sealed to your hardware, organized not as a transcript pile but as a queryable inventory of what you concluded and when. It belongs to you. It is portable across every AI. And it does not go away.
The archive captures the conversation, not just the answer. The questions you asked, the context that evolved, the reasoning that led to the decision. The thinking IS the asset — and it compounds over a lifetime.
This is not about preventing breach. It is about data quality — the difference between a number on a napkin and a calibrated instrument reading. Data with origin, ownership, and context is data an AI can trust and an auditor can verify.
Identity is not a single machine. It is sharded across the devices you own — laptop, phone, desktop. Lose one, replace it, carry on. Write to your address, all your devices listen. The keys never leave your hardware.
The agent era is the last clean chance to put the owner back at the center. There is one asset in the entire stack that you actually own: the device in your hands. That is where identity lives, where the archive grows, and where the proof begins. The PC is not a terminal to someone’s cloud — it is the root of trust for a lifetime of thinking.
Not what we claim. What the math demonstrates. Click the links below — these are real artifacts on Polygon mainnet, verified by anyone.
Birth certificate names the AI model and the key holder. Signed, on-chain, immutable. Verify the birth certificate →
Every prompt hashed. Every response hashed. Hash-linked into a tamper-evident chain. Merkle root settles the session. Verify a session archive →
Complete prompts and responses archived to IPFS, encrypted, recoverable from one wallet address. Owner-controlled. Read the test report →
Demonstrated using Morpheus decentralized inference (Kimi K2.5) in our lab. The architecture works with any AI — OpenAI, Anthropic, local models, any provider.
AI interactions are messages. We sign them. Every prompt, every response, every tool call, every policy decision — a signed message on the agent’s wallet. The chain of messages IS the proof.
The agent runs inside a Trusted Execution Environment. Hardware-sealed keys. Policy enforcement at the infrastructure layer, not in the prompt. The TEE proves what code ran.
Every interaction is a signed, hash-linked message. Not access control — message security. Each message references the previous one. Alter any message and the chain breaks.
One Merkle root covers an entire session. All messages. All services. All policy decisions. Anchored on-chain. One hash proves everything.
For AI governance and orchestration: every agent interaction — across every service, every model, every tool — visible, controllable, provable. Your policy. Your audit trail. Your proof. Walk through the full proof flow → See AI governance in action →
We don’t just build the technology — we help define the standards. Two formal submissions to NIST in 2026, both referencing this architecture and the live on-chain proofs on this page.
Docket NIST-2025-0035 — AI Agent Security.
Core thesis: “The security architecture for AI agents already exists
in trusted computing standards.” Proposes signed prompts, measured AI,
signed responses. 10 key arguments + 3 specific requirements.
AI Agent Identity & Authorization — Defines agent identity as a Merkle chain (not a static credential), four-factor message-level assurance, and includes live proof.rootz.global evidence. Birth certificate + session archive referenced as working demonstration.
You do. Rootz is the software, not the operator. We never see your traffic. Your keys are in your hardware. Your data stays in your enclave. We provide the infrastructure — you own everything it produces.
The solution runs locally on your desktop, on-premises in your data center, or as a managed service — from simple server-held keys to confidential compute to a hardware security module that becomes the agent’s trusted execution environment.
If you just got handed the Five Eyes guidance and were asked “are we compliant?” — we can help. Design partners, enterprise pilots, and integration support.
discover@rootz.globalOr explore: Compliance Demo • How It Works • AI Governance
We demonstrated this using Morpheus decentralized inference in our lab — real AI, real blockchain, real proofs. The architecture is provider-agnostic: it works with any AI that produces output.
We tested this on the Morpheus decentralized AI network — three real inference calls to Kimi K2.5, real tokens consumed, no centralized API. Morpheus was the lab. The architecture works with any provider: OpenAI, Anthropic, local models, enterprise endpoints.
The AI provides the thinking. Rootz provides the proof.
This is not a simulation. The birth certificate and session settlement are on Polygon mainnet.
Address: 0x70b893e3b519255166a1fb64dcde920d056a2d5c
Chain: Polygon Mainnet (137)
TX: 0xa689ba006882b0ee1fae319de9ac3362960d4e1ecb7777686891ba9d16f06f7c
Block: 84,799,553 — March 28, 2026
The content is encrypted (ECDH + AES-256-GCM). Only the owner can decrypt. But the events are publicly verifiable — anyone can confirm the contract exists, when Notes were written, and that the chain is intact.
Total on-chain cost: $0.03.
These share links decrypt the on-chain content in your browser. The encryption key is embedded in the URL — anyone with the link can read it. Without the link, the on-chain data is opaque.
The agent's permanent origin record — names the AI parent (Morpheus/Kimi K2.5) and the key-holder authorizer (Steven Sprague). Policy, scope, and key protection level.
The complete session: three prompts, three full Kimi K2.5 responses (4,213 tokens), all hashes, and the settlement Merkle root. This is the provable record of what the AI was asked and what it answered.
The technical test report documenting what was real, what was simulated, and the verification results. Published as a public (unencrypted) secret.
When your AI makes a decision that affects a customer or a regulation, you need proof of what it was asked and what it said. Not log files. Blockchain-anchored, cryptographically signed evidence.
The EU AI Act requires operational logs. The SEC requires disclosure of material AI use. Today, compliance is self-reporting. With this, the evidence is on-chain. Verify, don't trust.
If an AI causes harm, who is liable? With a birth certificate naming the model and a chain of signed actions, insurance can be priced per-model, per-version, per-agent.
You asked AI for medical, legal, or financial guidance. Later you need to prove what it told you. Today you have a screenshot. With this, you have cryptographic proof.
These claims are backed by real cryptography running in production. The math holds or it doesn't.
| Claim | How It's Proven |
|---|---|
| This agent exists and was authorized by the holder of this key | Birth certificate on-chain, signed by the authorizer's wallet. ecrecover(sig) == authorizerAddress. Forgery requires the private key. The authorizer could be a person, a company, another agent, or a smart contract. |
| This specific prompt was asked | SHA-256 hash of the prompt, signed by the agent. Pre-image resistance: 2256 search space. |
| This specific response was received | SHA-256 hash of the response content. If the hash matches, the content matches. |
| This happened in this order | Each Note contains the hash of the previous Note. Alter any entry and the chain breaks visibly. Same math as Bitcoin. |
| The session is complete and unmodified | Settlement Merkle root covers all actions. Any missing or altered Note changes the root. |
| The full conversation is preserved | Complete prompts and responses archived to IPFS, encrypted, recoverable from one wallet address. Not just hashes — the actual words. |
| The data is owned by the user, not the platform | Encrypted with the owner's key (ECDH + AES-256-GCM). The platform, the node operator, and the blockchain can't read it. Only the owner and those they share the key with. |
These require additional infrastructure we're building. The designs exist. The code is in progress.
| Claim | What's Needed |
|---|---|
| The provider actually ran this model | Layer 2: Provider signs responses with their registered wallet. Bilateral proof. Patch ready for our own Morpheus node. |
| The response wasn't modified in transit | Layer 2: Provider signature binds the response content to the provider's identity. No intermediary can alter it. |
| No one eavesdropped on the conversation | Layer 3: ECDH key exchange between agent and provider. AES-256-GCM encrypted channel. End-to-end privacy. |
| The inference ran in a verified enclave | Layer 3: TEE attestation (Intel TDX / AMD SEV). Hardware-signed proof that specific code ran in an isolated environment. |
| The model weights are genuine | Layer 4: Model built from signed sources. Weight hashes in a Reference Integrity Manifest (TCG RIM). Verified at load time inside the TEE. |
| The training data has provenance | Layer 4: Training data manifests with signed sources. Every dataset hashed, publisher signed. The AI equivalent of pharmaceutical traceability. |
| Any attested node can run this agent | HSM Network: Agent state lives in the Secret on-chain. Any node whose TEE passes attestation can load and run the agent. Portable like a smart contract. |
Each layer builds on the one below. Layer 1 is working today. Each subsequent layer adds trust without replacing what's already proven.
Each layer adds trust. Each layer requires different effort. Together they form the complete chain from "who asked" to "where did the model come from."
Agent signs prompt hashes, hashes responses, chain-links every action. Settlement Merkle root anchored on-chain. Works with any AI API today.
Provider signs every response with its registered wallet. Bilateral proof. Runs on your own Morpheus node.
ECDH key exchange. AES-256-GCM encrypted channel. TEE attestation proves the enclave. No eavesdropping.
Model built from signed sources. Training data manifests. Weight hashes. The AI equivalent of pharmaceutical traceability.
Rootz Desktop V6 is an Electron application that provides the signing, encryption, and blockchain infrastructure for data wallets. AI agents connect to it as a service — it’s the secure backend for everything described on this page.
Desktop V6 is the agent's hardware security module. It holds TPM-sealed signing keys, manages Sovereign Secrets on Polygon, encrypts content with ECDH + AES-256-GCM, uploads to IPFS, handles credit management, and provides an MCP server that any AI tool (Claude Code, Cursor, ChatGPT) can connect to.
The agent never holds a private key. Desktop signs on its behalf via a session token. If the agent is compromised, it has no key to steal. If the host dies, the owner derives a new key from their master seed and the agent's full state is recovered from the blockchain.
Open source. MIT license. Four packages, 22 source files, ~10,000 lines of TypeScript. Tested live on Morpheus + Polygon. 10 inference calls, 19,000+ tokens, real TPM signatures.
agent-runtime — unified types, Merkle chain, skill loader, Zod schemas
agent-wallet — SDK: createAgentWallet(), 3-call API, checkpoint/resume
morpheus-agent — Skill #1: Morpheus inference, session archiving, MCP tools
Built by Steven Sprague — rootz.global