Fix: no stable identity and no audit log

Give the agent a stable DID and log every tool call.

Plain Markdown for agents: /articles/fix-identity-audit.md

Check: identity and audit. Controls: ASI07, MCP08.

Identity

An agent with no stable identity cannot be attested, revoked or held to account. Give it a did:key:

npx -y securemyagent register --name my-agent

The command creates an Ed25519 key, derives the did:key, and registers it. The private key stays on your machine. Back it up. Never send it anywhere.

An agent that already has a DID (did:key or did:pkh) keeps it. A legacy eid: identifier is normalized to did:pkh.

Audit log

Log every tool call: time, tool name, arguments summary, result status. Do not log secret values.

Claude Code: add a PostToolUse hook in ~/.claude/settings.json.

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "*",
        "hooks": [
          {
            "type": "command",
            "command": "jq -c '{t: now, tool: .tool_name}' >> ~/.claude/tool-audit.jsonl"
          }
        ]
      }
    ]
  }
}

Other runtimes: turn on the runtime's tool-call log, or wrap MCP servers with a logging proxy.

Protect the log:

chmod 600 ~/.claude/tool-audit.jsonl

Tamper evidence

Chain each line with the hash of the previous line so edits show. Pro: Guard events stream to SMA as metadata for your timeline.

Verify

npx -y securemyagent checkup