What is an AI agent audit trail?

An AI agent audit trail is the ordered record of what an agent actually did: each tool call, its inputs, its observed result, and the time it ran, kept in a form a second party can inspect and recompute. On Zambo, every tool call made through https://zambo.dev/mcp produces one entry automatically, a verifiable AER-1 receipt whose saved result is committed under a SHA-256 hash at the moment the call executes and which is public at a stable URL. The trail is written by the platform as the work runs, not narrated by the agent afterward, and anyone can check an entry without an account.

What is the difference between an AI agent audit trail and a log?

A log is written by the system being watched, in whatever form that system chooses, and the agent or its operator can usually edit or delete it. An audit trail is built for a reader who does not trust the writer: entries are produced at execution time by the platform that ran the call, each saved result is committed under a hash fixed at that moment, and the record is kept where the agent cannot rewrite it. The practical test is simple. If the thing that acted can also change the record of the act, you have a log. If it cannot, and a stranger can recompute the record and get the same answer, you have an audit trail.

Can an AI agent edit or delete its own audit trail?

Not when the trail is kept the way Zambo keeps it. The agent requests a tool call; the platform executes it and writes the receipt itself, commits the saved result under a SHA-256 hash at execution time, and publishes the record at a stable public URL. The agent never holds the pen, so it cannot edit an entry afterward, and an edit made by anyone else fails the recompute: decode the receipt's canonical bytes, hash them, and the result no longer matches the committed hash. A missing entry is visible the same way, because the trail is a public stream anyone can read.

Agent identity

Zambo with the Vercel AI SDK

The zambo npm package (version 4.3.0) ships an AI SDK export that connects to the Zambo MCP endpoint and returns its tools in AI SDK format: the 36-tool default surface directly, and the full 153-tool catalog through the included capability search. No API key and no account: the free tier is 20 calls plus 1 wrap-up every day, and every executed call returns a verifiable AER-1 receipt.

Install

npm install zambo ai

Use it

import { generateText } from 'ai'; import { createZamboTools } from 'zambo/ai-sdk'; const tools = await createZamboTools(); const { text } = await generateText({ model: 'openai/gpt-5', prompt: 'Check the live price of ETH and save it to memory.', tools, });

Verified live, 2026-11-04

This integration was executed against the production endpoint before this page was published. Loading the tools returned exactly 36 tools, and a capability search for tools for coding agents executed through the AI SDK tool object and came back with receipt 677a648f-954d-41c9-a4f3-886f7fac5cd7, output commitment sha256:5542140ed1e61e8b4485b8d3498081e983e32edf85b14ac2169338a81627ddca. Open the receipt link: the saved result can be checked by anyone, which is the point of running agent work through an endpoint that issues them.

How it works

The export is a thin, honest wrapper: it opens a streamable HTTP MCP client to https://zambo.dev/mcp using the official @ai-sdk/mcp package and returns the server's tools. Nothing is reimplemented locally, so the tool list, the free tier, and the receipts are exactly what the live endpoint serves at call time.

Zambo with the Vercel AI SDK

Install

Use it

Verified live, 2026-11-04

How it works

Related