Asqav CLI
A CLI creates and checks signed agent-action receipts, exports audit records and verifies prepared bundles locally.
- 429 ★ on the repository
- Last commit
Broad access
Why this level
- Registering an event sends its contents to an external service and creates a signed account record.
- With sufficient key permissions, the CLI can erase event contents and change organization settings.
Install
Manual install
pip install "asqav[cli]"Installs the CLI and its dependencies; requires Python 3.10 or later. This is the CLI guide’s first command; we did not run it. Offline verification may also need the verify extra and trusted public keys.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Registering an event sends its contents to an external service and creates a signed account record.
- With sufficient key permissions, the CLI can erase event contents and change organization settings.
This is third-party code. Review the repository files before installing.
What it does
Asqav CLI sends details of an agent action to Asqav and receives a signed receipt. The signature links the event contents to earlier records. Verification reports signature validity separately from external timestamp confirmation. For an audit, you can export a receipt bundle and verify it offline against previously saved keys. The CLI also saves credentials, erases event contents and changes organization settings when the key permits it. It installs with the Python package’s optional CLI dependencies.
Who it is for. For developers who need signed agent-action records they can retain and share with an auditor.
Good fit when
- Verify a receipt without an account key.
- Export signed records for an external reviewer.
- Verify a bundle offline against trusted keys.
- Distinguish a valid signature from a pending timestamp anchor.
Not a fit when
- You need a signature alone to prove the reported event was true.
- Policy forbids sending action contents to a signing service.
- No trusted public key set is available for independent verification.
Example request
Verify this Asqav receipt, showing signature status, anchor state and missing evidence separately.Limitations
Signing new events requires the commercial Asqav service, and allowed operations depend on key permissions. A receipt establishes that signed contents have not changed; it does not prove that the agent reported the truth or acted lawfully. Independent verification of an export needs previously saved, trusted keys; otherwise, the bundle only vouches for itself. The client SDK uses Elastic License 2.0; signature-verification code and test vectors use Apache-2.0.
How to disable. Stop CLI calls and revoke unneeded service keys. Saved receipts and audit bundles remain verifiable with the required public keys.
FAQ
Does `asqav verify` require a key?
No. `asqav verify <signature_id> --output json` performs public receipt verification.
What does a pending anchor mean?
A signature can be valid while external timestamp confirmation is incomplete. The CLI reports them separately.
How do I verify a bundle offline?
Use `asqav audit-pack verify --offline bundle.json --jwks saved-jwks.json` with a previously trusted key set.
What does `asqav doctor` check?
The active key and API base, using the same configuration resolution as the SDK and CLI.
Does payload erasure remove the whole chain?
No. Erasure retains signatures, chain hashes and anchors so the receipt remains verifiable.
Discussion
No questions or reviews yet.
Related
CLI toolsAgentSafe is an agent API gateway that links an executed operation to a single-use grant and a record in its audit trail.
A Claude Code plugin signs every tool call with an Ed25519 key and keeps a log that can be verified offline
An MCP server with 47 tools: signed AI agent identities, W3C credentials, delegated permissions, an action log and EU AI Act documents
npq is an npm-audit CLI whose JSON mode separates the report from dependency installation and never starts the package manager.
A plugin that checks the commands, URLs and file writes an AI agent attempts and blocks the dangerous ones before they run
A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
README in short
Commands can return JSON for scripts. Strict session verification requires a signed record for each step; a reconstructed description without a signature will not pass.