protect-mcp-adk: Ed25519 receipt signing plugin for ADK agents

[tomjwxf]

I built an Ed25519 receipt signing plugin for Google ADK agents: every tool call produces a cryptographic receipt following the IETF Internet-Draft format.

Install

pip install protect-mcp-adk

Usage

from google.adk import Agent
from google.adk.tools import FunctionTool
from protect_mcp_adk import ReceiptPlugin, ReceiptSigner

signer = ReceiptSigner.generate()

agent = Agent(
    model="gemini-2.0-flash",
    tools=[FunctionTool(my_tool)],
    plugins=[ReceiptPlugin(signer, auto_export_path="receipts.jsonl")],
)

What it does

Every tool call your ADK agent makes produces a signed receipt:

• Ed25519 signature over JCS-canonicalized (RFC 8785) payload
• Privacy-preserving: tool inputs/outputs are SHA-256 hashed, not stored raw
• Chain-linked: each receipt includes previousReceiptHash (tamper-evident ordering)
• Offline verifiable: npx @veritasacta/verify@0.2.5 receipts.jsonl --key <pubkey>
• Hooks into ADK's after_tool_callback via BasePlugin (zero changes to existing agents)
• Error receipts via on_tool_error_callback

Cross-language interop

Python-signed receipts verify with the same Node.js verifier used by three other independent implementations:

• protect-mcp (TypeScript, MCP/Claude Code)
• Agent Passport System (TypeScript)
• asqav (Python)

Four implementations, two languages, one IETF draft, one verifier. Receipt format convergence is real.

Why this matters

As ADK agents move into production, compliance teams need verifiable proof of agent behavior. Centralized logs can be tampered with. Receipts are independently verifiable by any third party, offline, without trusting the agent operator.

The receipt format is standardized as an IETF Internet-Draft: draft-farley-acta-signed-receipts

Links

• PyPI: https://pypi.org/project/protect-mcp-adk/
• IETF Draft: https://datatracker.ietf.org/doc/draft-farley-acta-signed-receipts/
• Verifier: https://www.npmjs.com/package/@veritasacta/verify (Apache-2.0, offline)
• Related issue: RFC: Audit receipts for ADK agent tool execution #5164