Question: would signed MCP tool-call receipts be useful here?

[cullenmeyers]

Hi — I found this MCP server and wanted to ask a quick architecture/product question.

I’m building a small open-source project called AgentReceipt for structured, verifiable action records around AI agent/MCP tool calls.

The idea is not to replace normal logs or observability. It is more for trust-boundary actions where someone may later need to prove what happened: caller X invoked tool Y with args Z, the server/tool boundary attested the result, and the receipt can be verified later.

This repo seemed relevant because feature flags / rollout configuration can affect production behavior, so MCP tool calls around flag or environment changes may need more than ordinary debug logs.

Repo for context: https://github.com/cullenmeyers/AgentReceipt

Would this kind of server-side receipt/provenance layer be useful around Unleash MCP tool calls, or would existing Unleash audit logs / normal observability already cover the need?

No worries if this is out of scope — I’m mainly trying to learn where this fits or does not fit.

[gastonfournier]

Hi @cullenmeyers your project looks interesting, currently Unleash has audit logs and change requests in the enterprise version to protect from agents, also all calls from our MCP are authorized by a specific service account token. Nonetheless your project seems interesting but we don't have time at the moment to look into this.

[cullenmeyers]

Hi Gastón, Thanks — that makes sense. If Unleash already has enterprise audit logs, change requests, and service-account authorization around MCP calls, then AgentReceipt may not add much unless there is a need for a portable receipt that can be verified outside the Unleash system. That helps clarify the boundary for me: AgentReceipt should not duplicate internal audit logs; it only becomes useful when the record needs to cross a trust boundary. Appreciate you taking a look.

…

On Mon, Jun 1, 2026 at 9:50 PM Gastón Fournier ***@***.***> wrote: Hi @cullenmeyers <https://github.com/cullenmeyers> your project looks interesting, currently Unleash has audit logs and change requests in the enterprise version to protect from agents, also all calls from our MCP are authorized by a specific service account token. Nonetheless your project seems interesting but we don't have time at the moment to look into this. — Reply to this email directly, view it on GitHub <#12140?email_source=notifications&email_token=B3KDSV24TZPW4HMZJXDB22T452BM7A5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZRGQ4DCOBZUZZGKYLTN5XKO3LFNZ2GS33OUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#discussioncomment-17148189>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/B3KDSV3LUTWG2KVYYUWPEUT452BM7AVCNFSM6AAAAACZTDL7AKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTOMJUHAYTQOI> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/B3KDSVZOIHA5QZUBMBU3CCD452BM7A5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZRGQ4DCOBZUZZGKYLTN5XKO3LFNZ2GS33OUVSXMZLOOSVGM33PORSXEX3JN5ZQ> and Android <https://github.com/notifications/mobile/android/B3KDSV3YDDUOP6SNVZB5T23452BM7A5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNZRGQ4DCOBZUZZGKYLTN5XKO3LFNZ2GS33OUVSXMZLOOSXGM33PORSXEX3BNZSHE33JMQ>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>