dengyier/OpenWorkProof

Open protocol for AI agent work contracts and verifiable execution — authorization, evidence, and acceptance for multi-agent systems

What it solves

OpenWorkProof addresses the trust gap in AI Agent execution. While existing tools focus on connectivity (like MCP), they cannot prove that an agent's actions were authorized, performed within agreed-upon boundaries, or formally accepted by a human. It prevents situations where an agent claims a task is "completed" without verifiable evidence of authorization and execution.

How it works

It functions as an open protocol layer that can be embedded into existing agents, CI/CD pipelines, and orchestrators. It creates a cryptographically signed evidence chain consisting of six key components:

  1. WorkOrder: Defines the goals, tools, and acceptance criteria.
  2. CapabilityGrant: A signed authorization from an authority.
  3. PolicyDecision: A pre-execution check to allow or deny an action.
  4. ActionReceipt: A record of the actual action and its result.
  5. VerificationDecision: An independent assessment of the evidence.
  6. AcceptanceDecision: The final human sign-off.

Using Ed25519 signatures and normalized JSON, it ensures that any modification to the evidence chain results in a verification failure. It also introduces a "Human Agency Profile" to strictly define which capabilities an agent can use autonomously versus those requiring human intervention.

Who it’s for

  • AI Agent Developers: To make their agents' work more trustable and delegatable.
  • Enterprise Teams: Who need a verifiable audit trail for agent-led code changes or system modifications.
  • Third-party Auditors: Who need to verify agent work offline without accessing the original system.
  • MCP/Agent Framework Users: Who want to add a layer of formal authorization and acceptance to their workflows.

Highlights

  • Cryptographic Evidence: Generates signed evidence bundles that can be verified offline using public keys.
  • Human-in-the-Loop: Explicitly separates the roles of execution, verification, and acceptance to prevent agents from self-approving their work.
  • Human Agency Profile: Allows humans to define granular boundaries (allowed, reserved, denied) for agent autonomy.
  • Framework Agnostic: Can be integrated via Python API, CLI, GitHub Actions, or as an MCP server.
  • Verification Integrity: Includes mechanisms to ensure that verification results are based on a complete and agreed-upon set of evidence.

Related

  • Project
    cyberchitta/llm-context.py

    A context curation tool that enables AI coding agents to automatically identify, pack, and manage the specific files and code excerpts needed for a task to avoid token limits and missing information.

  • Project
    cha0upup/LeoAI

    LeoAI is an open‑source, AI‑augmented red‑team platform that combines a web dashboard, dual Java/PHP Puppet runtimes for remote host control, and LangChain4j‑driven LLM agents to automate post‑exploitation tasks, generate reports, and manage teams—all deployable via a JAR or Docker.

  • Project
    sspsec/Scan-Spring-GO

    A Go-based vulnerability scanner and exploitation tool for the Spring framework that integrates with AI agents via MCP to automate penetration testing.

  • Project
    tumourlove/monolith

    An MCP-based plugin for Unreal Engine that exposes over 1,400 editor actions to AI assistants using a namespace-dispatch pattern to minimize context window usage.