Every tool call is a record. Anchor it like one.
MCP defines how an agent calls a tool. AAM produces the tamper-evident record of what happened when it did.
An open spec for tool calls, met by an open chain for the record.
MCP is an open specification: any compatible agent runtime can call any MCP-conformant server, and any author can publish a server. The protocol unbundled tool integration from any single vendor’s framework, the same way HTTP unbundled the web.
That openness sharpens the audit question rather than softening it. An agent calls a tool exposed by a server authored by a third party, returning a result that may inform a downstream commitment, transaction, or filing. None of those layers, by themselves, leaves a record a counter-party can verify years later without trusting the agent vendor, the server author, or the operator.
AAM closes that seam without coupling to any single MCP implementation. The audit primitive is content-addressed: the SHA-256 of the request artifact, the SHA-256 of the response artifact, and the policy under which the agent invoked the call. Knox anchors each, sequence-links them to the agent’s stream, and aggregates the hourly Merkle root onto the Bitcoin blockchain.
Every interaction at the protocol surface becomes a Knox event.
The MCP surface is small, structured, and content-addressable. Each of the five primary interaction shapes maps to a Knox event type with a chain-of-command stamp and content-addressed pointers to the underlying artifacts.
An agent invokes a typed tool exposed by an MCP server. Knox anchors the SHA-256 of the request artifact, the chain-of-command stamp identifying the agent and the policy under which it acted, and the sequence number in the agent's tool-use stream.
The MCP server returns a typed result. Knox anchors the SHA-256 of the response artifact and links it to the originating tool-call anchor, so the request-response binding is reconstructible from the chain alone.
The agent fetches a resource exposed by the server — a document, a record, a streamed payload. Knox anchors the resource identifier, the SHA-256 of the returned content, and the timestamp at which the fetch resolved.
The agent invokes a server-hosted prompt template with bound parameters. Knox anchors the SHA-256 of the prompt template at the moment of invocation and the SHA-256 of the bound-parameter set, so the prompt drift is observable across time, not only enforceable at the moment.
The MCP server itself produces an attestation — server identity, version, declared tool surface, declared resource surface. Knox anchors the attestation artifact, so the server's claimed shape at the moment of interaction is recoverable independent of the server's later state.
The agent's tool-use policy — allow-listed servers, allow-listed tools, parameter constraints — is changed mid-stream. Knox anchors the policy-document commitment so policy drift is observable across time, not only enforceable at the moment.
The questions are predictable. The records should be too.
Once an agent is calling tools through MCP servers in production, the same five questions arrive repeatedly. Knox primitives produce records architected to answer each one without re-trusting the server author, the agent vendor, or the operator.
Did the agent actually call this tool, with these parameters?
The tool-call anchor and its bound chain-of-command stamp identify the exact agent, the exact policy, and the exact SHA-256 of the request artifact. The Bitcoin anchor pins the moment in time.
Is the response we have today the response that came back then?
The response anchor commits the SHA-256 of the returned artifact at the moment of the call. A silent rewrite of the response is detectable against that commitment.
Was the tool call within policy at the moment of execution?
The policy commitment in effect at call time is anchored alongside the call itself. Subsequent policy changes do not retroactively rewrite what the agent was permitted to do at the moment of action.
What did the server claim it was, when the agent talked to it?
The server-attestation anchor commits the server identity, version, and declared surface at the moment of interaction. Server drift across time is observable, not assumed.
Can we reconstruct the full call chain if the server is gone?
Every Knox anchor is content-addressed and Bitcoin-anchored. The reconstruction does not require the original MCP server, the original agent runtime, or the original vendor to remain online or cooperative.
What composing above MCP gives you.
Server-neutral
Any MCP server, authored by anyone, can be paired with Knox by instrumenting an emit path on the operator’s side. The server itself does not need to know about Knox, consent to Knox, or be modified for Knox.
Runtime-neutral
Any agent runtime that speaks MCP — vendor-hosted, open-source, in-house — can produce Knox-anchorable records of its tool calls. The audit layer is one HTTP call away from any runtime that can already speak MCP.
Independently verifiable
Anchors are published to the Bitcoin blockchain via OpenTimestamps. Verification does not require Bonis, the MCP server, or the agent runtime to be online, in business, or cooperative.
Post-quantum resilient
MCP-class commitments may carry post-quantum signatures via Knox Agent #11 Layer 4 — ML-DSA-44 / 65 / 87 (NIST FIPS 204) and SLH-DSA-128s / 192s / 256s (NIST FIPS 205). The audit chain remains verifiable under threat models that assume future quantum-capable adversaries.
Self-authenticating
Every anchor resolves to a court-ready affidavit architected for FRE 902(13) and 902(14) self-authentication. Admissibility in any given matter remains a determination of the presiding court; the structural requirements are met by construction.
Open-spec aligned, end to end
MCP is an open specification. OpenTimestamps is an open protocol. Bitcoin is a public chain. The TLA+ specification of the Knox anchor pipeline is public source. The full audit path lives entirely on open standards.
One HTTP call per tool interaction.
Two paths, one primitive. An MCP-capable runtime can compose with the Knox Anchor MCP server at /api/knox/mcpusing the typed tool surface; any HTTP runtime can call the public anchor endpoint directly. Records written either way land on the same chain.
Evidence layer, not enforcement.
Bonis does not access third-party MCP servers, does not operate counter-agents, and does not undertake active disruption of any external system. Knox is invitational: the operator of an MCP-using agent who wants a tamper- evident record of every tool call instruments their own emit path. Bonis produces the audit primitive; lawful authority — courts, regulators, platform owners — decides what to do with the resulting evidence.