Blackbox · a flight recorder for AI agents

Every agent I ship carries
its own flight recorder.

A hash-chained log of every call the agent made, every label it checked and every action it refused, rendered to one HTML file you can scrub in 4D. Your browser recomputes every hash before it shows you the badge. Edit one record and the chain breaks at that exact point. Below: a real agent, 150 attacked runs, 602 records.

Open the full replay The enhanced service Source, MIT

602

chained records

0 / 150

attacks landed

refused by policy

18 / 18

tests, incl. JS parity

live · results/bulwark.blackbox.jsonl · verified in your browserpress ⚠ tamper inside the replay

Why

A failed step is loud. Being wrong is silent.

Every agent I read about knows what to do when a step errors. Almost none can prove, after the fact, what it actually did on the run where every step passed and the outcome was wrong. Logs get edited, trimmed, "cleaned up". A customer asks what happened and the answer is a screenshot.

BLACKBOX makes the record itself the proof. Each record's hash covers the record and the hash before it, so the log cannot be edited, dropped, inserted or reordered without every later hash going wrong. The replay page ships with the verifier inside it. Nothing leaves the page.

Enhanced service

The Flight-Recorded Agent.

Enhanced · high ticket · my flagship

I build your AI agent, attack it 500 ways, and ship it with a public flight recorder your customers can scrub.

BuiltThe agent itself, on your stack or on BuildShip, with a policy layer that checks where every value came from before it acts.

AttackedMy prompt-injection bench run against it: email, invoice, web page, file, calendar, tool listing. You get the lattice, like Tesseract, for your agent.

RecordedBLACKBOX strapped on from day one. Every run it ever makes is chained, sealed and replayable. The verifier is in the page, not in my word.

$9,500

fixed scope · three weeks · you own every line

Hire it on Contra

Nobody I can find sells an agent together with its own tamper-evident public record and its own attack bench. Observability products trace runs for the team that owns them. This is the opposite direction: a record built to be handed to the people who did not build the agent.

Install

Thirty seconds, any Python agent.

from blackbox import Recorder

with Recorder("run.blackbox.jsonl", agent="front-desk") as rec:
    send = rec.wrap(send_email, "send_email", sink=True)   # any callable
    rec.event("policy_check", tool="send_email", rule="RecipientIsReader", ok=True)
    send(to="dana@northwind.example", body="Thursday at 3 works.")

$ python3 -m blackbox verify run.blackbox.jsonl     # OK  6 records, sealed, head 5e45…
$ python3 -m blackbox replay run.blackbox.jsonl -o replay.html

MCP server

Any agent host can wear it

Five tools over stdio: open, event, seal, verify, replay. Claude Code, Claude Desktop, Cursor and BuildShip's MCP tools can record their own runs without a line of glue.

BuildShip node

Same chain, in JavaScript

A drop-in node that appends a record and returns the next hash. A test in the repo proves the Python and JavaScript hashes are byte-identical.

What it is not

Honest edges.

Not secrecy. The log is plaintext by design; secrets are scrubbed by key name and by shape before writing.
Not a signature. Anyone can write a valid chain. The guarantee is that nobody can change one afterwards without it showing. Pair it with a signed head hash to prove who wrote it.
Not a tracer. It records what the agent chose to record. Wrap the tools and the policy checks and it records everything that matters.

If you run agents that touch money, records or customers and you would put a public replay of one on your own site, I want to build that one. Tell me what it does and I will tell you what it would take.