Project AIR is an open-source toolkit that keeps a tamper-proof record of what AI agents do. Every action an agent takes gets signed, chained to the step before it, and tied to the person who authorized it. The chain is anchored to Sigstore Rekor, a public transparency log, so anyone can check later that nothing was changed or deleted. When something goes wrong, you can show exactly what happened and who approved it, instead of just saying it happened.

It also runs 16 detectors over every record, covering all ten risks on the OWASP Top 10 for Agentic Applications, three from the OWASP list for LLM apps, and three of its own. It can stop an agent mid-action until a person signs off. It plugs into LangChain, LlamaIndex, and the OpenAI, Anthropic and Gemini SDKs with a line or two of code.

I built the Python library and command-line tool, published on PyPI as projectair (now at version 1.3.1) under the Apache 2.0 license, plus the website and dashboard in SvelteKit. We run it on our own infrastructure too: every request to vindicara.io is recorded and anchored to Rekor every minute.

Impressive work! 👏 Excellent approach to AI agent security, tamper-proof audit trails, and human oversight for more trustworthy AI systems.

🌙 3:07 AM. Your team is asleep. Your AI agents aren't. 🤖

While you sleep, they: 💬 Reply to every new lead in seconds 📅 Book the slot straight into your calendar 🔔 Follow up before the lead goes cold 📊 Have your morning summary ready

☀️ You wake up to bookings, not missed messages.

🚀 I build AI agents for startups and small businesses. 🎁 Message me for a free of cost demo on your own services and prices 👋

The morning summary is what sells it. Owners want to see what happened overnight before they trust it.