signed-audit-trails-recipe

To create verifiable audit logs for Claude Code tool calls, install the protect-mcp hook and follow the provided cookbook steps to generate cryptographically signed Ed25519 receipts after each tool execution.

Tamper-evident provenance uses Ed25519 receipts to cryptographically verify tool interactions. SLSA-style integration correlates this activity with releases by attaching the receipt chain as build provenance in CI/CD pipelines.

Yes, you can verify signed tool-call receipts offline. The cookbook demonstrates offline verification and tamper detection for Ed25519 receipts, allowing you to audit tool interactions without network connectivity.

Yes, Cedar policy evaluation gates all Claude Code tool calls before execution. The cookbook demonstrates how to apply these policies to ensure only authorized interactions proceed in regulated environments.

The best way to demonstrate verifiable provenance for regulators is through tamper-detection demonstrations using the signed receipt chain, proving the integrity and authenticity of tool interactions during audits.

Yes, you need the protect-mcp runtime hook installed in your project to generate signed audit trails. The cookbook serves as a guide for setting up this hook before committing to the full runtime configuration.