asqav-sdk
Python and TypeScript SDKs for verifiable, cryptographically signed AI agent compliance receipts.
Generate post-quantum signed audit trails and policy enforcement for LangChain, CrewAI, and MCP.
Asqav SDK provides Python and TypeScript libraries to generate cryptographically signed, hash-chained compliance receipts for AI agent actions. It suits government and smart city AI engineers requiring rigorous, tamper-evident audit trails for automated systems.
What it is
The SDK hooks into popular frameworks like LangChain, CrewAI, and LlamaIndex to sign every agent action using ML-DSA-65 post-quantum cryptography. It timestamps actions against independent witnesses and includes peer-to-peer receipt validation for multi-agent hand-offs.
Who it's for
It suits developers building audited AI deployments in regulated public sectors who need cryptographic proof of agent behavior. It does not suit teams seeking purely local, un-hosted audit solutions, as the cryptography currently relies on a commercial signing service.
Key features
Post-Quantum Signing
Uses ML-DSA-65 FIPS 204 signatures for cloud-issued receipts.
Zero Native Dependencies
Both Python and TypeScript client packages have zero native dependencies with cryptography running server-side.
Agent-to-Agent Hand-Offs
Validates peer receipts and generates acknowledgments bound to exact sender byte payloads.
Multi-Framework Adapters
Ships with native integrations for LangChain, CrewAI, LlamaIndex, OpenAI, Anthropic, and MCP.
Up and running in 3 steps
Our honest verdict
What's great
- Generates portable receipts verifiable by anyone without an account or API key
- Computes chain hashes locally using RFC 8785 canonical payloads for zero-trust verification
- Supports cross-language conformance fixtures to prevent drift between Python and TypeScript
- Provides offline verification utilities via JWKS and standalone Python modules
Where it falls short
- Relies on a commercial signing service for cloud-issued receipts
- Remote execution environments like E2B or Docker drop tool wrappers, breaking signature capture
- Requires managing API keys and environment variables across multi-agent deployments
Pricing & license
The client SDK is source-available under the Elastic License 2.0 with open verifiers under Apache-2.0, paired with a commercial signing service.
Open remote AI-training roles
880 open remote AI-training roles, updated November 15, 2026; most pay $20–$175 an hour. Zekai lists them free; the application goes to the employer’s platform.
Alternatives
These reviewed AI tools do the same job instantly — from our scored directory.
Use it, or have us set it up
FAQ
Can auditors verify receipts without an Asqav account?
Yes. Anyone holding a signature ID can verify receipts and check chain hashes without registering an account or possessing an API key.
Which frameworks are natively supported?
The SDK includes built-in adapters for LangChain, CrewAI, LlamaIndex, LiteLLM, Anthropic, OpenAI, Smolagents, and MCP.
How does offline verification work?
You can use local verification helpers like asqav.verify_receipt_offline() in Python or verifyReceiptOffline() in TypeScript using fetched JWKS.
