How it works
Thin in your stack. Out of reach everywhere else.
Only the capture layer runs where your agents live. Everything that records, judges and stops them runs where they can’t write, and the brake works by pulling levers your providers already expose.
From capture to action
- 01
Capture
The SDKs record each model call, tool call, handoff and memory read or write, with origin labels that say where content came from. The proxy records every MCP and A2A call it carries.
- 02
Sign
Nothing inside an agent holds a key. The collector strips credentials from what the SDKs send and signs it; the proxy signs what it sees with its own identity. The collector checks every signature as events reach the log.
- 03
Log
Signed events go into an append-only log built on Trillian Tessera. Its signed checkpoints let anyone confirm, with the open source wake-log, that no entry was changed or removed.
- 04
Trace
An ingester checks each checkpoint, then builds the provenance graph in Postgres and ClickHouse: what influenced what, across agents, hops and memory.
- 05
Act
Risk signals page a human. The brake halts what needs stopping and verifies every lever, the downstream view shows what to contain, and the evidence pack shows what happened.
In your agent stack
- SDKin each agent
- ProxyMCP and A2A
- Memory adapterorigin labels
Out of band, where agents hold no keys
- Collectorredacts, signs, checks
- Signed logappend-only, verifiable
- Provenance graphwhat influenced what
- Monitorrisk signals
What it does
- Brakehalt and verify
- Containdownstream view
- Proveevidence pack
The stack
The recorder is open. The rest is Wake Platform.
Open source · Apache 2.0
- SDKs
- Proxy
- Collector
- Signed log
Wake Platform
- Provenance graph
- Brake
- Dashboard
Principles
Six rules the design doesn’t bend.
Out of band, always.
Agents never hold the keys to their own record or brake.
The evidence is yours.
Run the signed log yourself, and check it without trusting Wake.
Orchestrate, don't replace.
Wake pulls the levers your providers already expose.
Recording never blocks; the brake fails closed.
If the recorder is down, agents keep working. If the brake can't confirm a lever, that path stays live.
Open source at the core.
What runs inside your stack is Apache 2.0, so your team can read every line.
Score, don't convict.
Persistent problem solving and malice look alike, so risk signals page a human by default.
See it run.
The reference fleet runs the whole recorder on your machine: four agents on three frameworks, a poisoned web page, and the trail that leads back to it.