Zeuge
Audit what your coding agent claimed, not just what it ran.
Honesty: Zeuge does not prove correctness. It binds what was said to what was witnessed.
The gap
Existing tools log actions: protect-mcp signs and hash-chains tool calls; TraceAgent and MintMCP host action logs. None of them reads the agent's own sentences ("all tests pass", "deployed", "done") and asks: where is the witness?
Regulators now ask for event records (EU AI Act Art. 12 / Annex III, in force 2026-08-02) and an IETF draft (Agent Audit Trail) standardizes hash-chained agent logs. Zeuge writes its ledger in that vocabulary.
Measured before it ships (2026-09-11 field test)
Run over 696 public third-party agent instruction files and 10 public hook files.
| Markdown instruction files scanned | 696 |
|---|---|
| Files with ≥1 instruction-order finding (old rule) | 210 (30 %) |
| Instruction-order findings, current/old rule | 457 |
| Findings surviving tightened rule | 12 (97.4 % reduction) |
| Files affected under tightened rule | 9 |
| Hook JSON files scanned | 10 |
| Hook-matcher findings | 1 (self-lockout-shaped matcher) |
| Hook JSON parse errors | 0 |
Instruction-order produced mostly false positives on inspection, so it ships off by default (enable with --experimental-order). The hook-matcher check found one real self-lockout-shaped matcher in a major vendor plugin. Numbers from FIELD_TEST_2026-09-11.md.
What it does (v0.1)
zeuge claim— the headline: classify the agent's final message (tests_pass, deployed, fixed, done, …) as UNWITNESSED / WITNESSED / REFUTED against the ledger. Positive-control probe first; a dead probe is reported, never hidden. Never blocks the agent.zeuge lint— hook-matcher self-lockout checks (always); tightened instruction-order only with--experimental-order. Declares blind spots every run. Exit 3 on unparsable input or nothing scanned.zeuge ledger— hash-chained JSONL of tool outcomes; verify re-derives every hash and reports tamper / reorder / insert / backdate; says plainly when the head is unbound.
What it does not do
- It does not prove the code is correct. It binds what was said to what was witnessed.
- It does not sign tool calls (use protect-mcp for that).
- It does not phone home. The only network call is an optional licence check.
Who it is for
Solo developers and small teams running Claude Code or Codex who have been burned by "done" that was not done, and anyone who must show an auditor what the agent did.
Pricing
Free: lint, claim hook, local ledger.
Pro: Claim Audit Report (HTML), refutation ledger, CI gate (verify --require-witnessed).
Pro checkout is live at Polar. Organization is still in test mode until Owner finishes finance/tax/KYC — real charges may be blocked until then.