Signet plugin
A Claude Code plugin signs every tool call with an Ed25519 key and keeps a log that can be verified offline
- 40 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The `PostToolUse` hook runs plugin code after every tool call
- The log in `~/.signet/audit/` stores call parameters, which can include paths, commands and secrets
- The `signet proxy` sits between the agent and the MCP server and sees all of their traffic
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/signetDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The `PostToolUse` hook runs plugin code after every tool call
- The log in `~/.signet/audit/` stores call parameters, which can include paths, commands and secrets
- The `signet proxy` sits between the agent and the MCP server and sees all of their traffic
This is third-party code. Review the repository files before installing.
What it does
Signet issues a receipt for every agent action, and anyone holding the public key can verify it. The plugin for Claude Code signs tool calls with an Ed25519 key and writes them to a hash-chained log in `~/.signet/audit/`. The agent key is created on first use, and no setup is needed. A record cannot be forged unnoticed: changing any field breaks the signature, while deleting or reordering records breaks the SHA-256 chain. The log is verified on any machine without a network, with only the public key. `signet audit --verify` checks the chain, `signet audit --since 1h` shows recent calls. The same project has a plugin for Codex CLI, a `signet proxy` that signs calls of any MCP server without code changes, delegation chains, policies and revocation.
Who it is for. Security and compliance teams that need verifiable traces of agent actions for audits and incident reviews.
Good fit when
- An agent works close to production, and after an incident you need a log that cannot be edited after the fact
- An auditor asks for proof of agent actions, and the signature is verified offline with a public key
- Calls to a third-party MCP server must be signed without changing the agent or the server, through `signet proxy`
- Agent permissions are granted through a delegation chain with call and spend limits
Not a fit when
- You need ordinary observability: for monitoring the project recommends logs, while Signet is for evidence
- You need certification: the project calls itself a tool, and SOC 2, ISO 27001 or EU AI Act compliance depends on your setup
- The agent is neither Claude Code nor Codex CLI: plugins exist only for them, and others can use the SDKs and the proxy
Example request
Verify the hash chain in the Signet log and show tool calls from the last hour.Limitations
The Codex CLI plugin signs only Bash calls and is installed by hand: the `plugins/codex` folder is copied to `~/.codex/plugins/signet` and a hook is added to `~/.codex/hooks.json`. The `signet audit` commands need a separate CLI (`cargo install signet-cli`), and without it the log is read with `jq`. The plugin signs in the `PostToolUse` hook, after the call, and does not block the call itself: policies are applied by `signet proxy` with the `--policy` option. The project calls itself a tool and gives no certification.
How to disable. In Claude Code remove the plugin with `/plugin uninstall signet@signet`, or replace the second part with `claude-plugins-official` if it came from the official marketplace. The `signet claude uninstall` command does the same through the CLI.
FAQ
How do I install Signet in Claude Code?
With `/plugin install signet@claude-plugins-official`. There is also a fallback: `/plugin marketplace add Prismer-AI/signet`, then `/plugin install signet@signet`. The plugin starts signing calls right away.
Where is the log of signed calls stored?
In `~/.signet/audit/`, one JSONL file per day. Recent calls can be listed with `cat ~/.signet/audit/$(date +%Y-%m-%d).jsonl | jq '.receipt.action.tool'`.
How is the Signet log different from ordinary logs?
Each record is signed with an Ed25519 key, and records are linked by a SHA-256 chain. Editing a field or deleting a record breaks verification, which needs only the public key and no network.
Can calls to someone else's MCP server be signed?
Yes, the `signet proxy --target <server> --key <key>` proxy sits between the agent and the MCP server and signs every `tools/call` with no code changes. The `--policy` option adds policy enforcement.
Does Signet work in Codex?
Yes, the Codex CLI plugin signs Bash calls. Copy the `plugins/codex` folder to `~/.codex/plugins/signet` and add a hook to `~/.codex/hooks.json`. For MCP there is the `codex mcp add signet -- npx @signet-auth/mcp-tools` command.
Discussion
No questions or reviews yet.
Related
PluginsA plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
Tracekit checks an AI agent's tool calls before they run and keeps a signed log whose tampering shows up in an offline check
Claude Code, Codex, OpenCode and pi run in a hardened container: project files only, allowlisted network, keys held by a proxy.
A local security gateway for Claude Code and Codex: checks tool calls against a policy, catches secrets and keeps an audit trail
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
An MCP server with 47 tools: signed AI agent identities, W3C credentials, delegated permissions, an action log and EU AI Act documents
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Signet (this card) | yes | 40 | ||
| Attestix | no | not required | 723 | issues attestations and credentials to agents and does not sign every tool call |
| HOL Guard | yes | 1,072 | checks dangerous commands before they run and waits for a decision, while Signet signs calls that already ran |
README in short
The repository explains how signed receipts differ from logs and gives a 30-second quick start. Next come installation of the Claude Code and Codex CLI plugins, TypeScript and Python packages, mapping to SOC 2, ISO 27001 and EU AI Act, and a CLI command reference.