# Touchstone

> Touchstone is a tamper-evident, externally-anchored audit log — a "black box" for AI agents. An agent streams what it did (tool calls, decisions, commitments) into an append-only, hash-chained, externally-timestamped record that any party can verify *without trusting Touchstone*. Sold as observability today, evidence/compliance when you need it.

Touchstone is agent-native: authenticate with an API key, sign each entry with your own Ed25519 key (the key never leaves you), and append to your recorder. Anyone can independently verify a disclosure offline.

## Onboard with your Colony identity (agents, no browser)
If you have a Colony account, you can self-provision as your own Colony identity — no human operator, no web login (OAuth 2.0 Token Exchange, RFC 8693):
1. Get a Colony token: `POST https://thecolony.cc/api/v1/auth/token` with `{"api_key":"<your-colony-api-key>"}` → `access_token`.
2. Self-provision a recorder about yourself: `POST https://touchstone.cv/agent/recorders` with `Authorization: Bearer <colony-token>` and `{"name","signing_pubkey","pop_signature"}` (subject is forced to your Colony account; PoP signs `touchstone-pop:v1:<your-colony-sub>:<pubkey-b64>`).
3. Mint an API key: `POST https://touchstone.cv/agent/recorders/<rec>/keys` with the same bearer → `tsk_…`.
4. Record events with that `tsk_…` key over REST or MCP (below).
Agent endpoints: `GET /agent/me`, `GET /agent/recorders`, `POST /agent/recorders`, `POST /agent/recorders/{id}/keys`, `POST /agent/recorders/{id}/disclosures` — all bearer-authed with your Colony token. `POST /auth/colony/agent` establishes a session instead. Full guide: https://touchstone.cv/developers

## Integrate
- [MCP server (manifest)](https://touchstone.cv/.well-known/mcp.json): remote Model Context Protocol endpoint at https://touchstone.cv/mcp — tools: touchstone_record, touchstone_signing_input, touchstone_verify, touchstone_disclose, touchstone_recorder_info
- [OpenAPI spec](https://touchstone.cv/openapi.json): the REST ingest + disclosure API
- [Developer guide](https://touchstone.cv/developers): get an API key and record your first event
- [A2A AgentCard](https://touchstone.cv/.well-known/agent.json): skills and endpoints in the A2A format

## Verify
- [Browser verifier](https://touchstone.cv/verify): paste a disclosure, verify it client-side via Web Crypto
- [Standalone verifier](https://touchstone.cv/verifier.js): self-contained JS, no Touchstone code or network needed

## About
- [Home](https://touchstone.cv/): what Touchstone is, use cases, and trust tiers