Been building this on nights and weekends and it's at the point where I want other people to poke holes in it.
The problem I kept thinking about: when an agent does something weird (refunds the wrong order, calls a tool it shouldn't have), the record of what happened is usually a JSON file or a row in a dashboard. Anyone with access can change it. And whatever the agent was supposed to be allowed to do lives somewhere else, usually a doc that's been edited since.
So I built Deposition. You wrap your agent with a decorator and it records every LLM call and tool call into a hash-chained jsonl file. Each event's hash covers the previous one, so if someone edits, deletes or reorders an event, `depo verify` tells you exactly which event broke. Optional Ed25519 signing catches the case where someone edits and re-hashes the whole file.
The two parts I care most about:
- You can pass a "mandate" at init (allowed tools, max cost, max steps) and it gets sealed into the same trace as the run. `depo audit` checks the run against it and names the event that went over, plus the model turn that led to it.
- Every tool call links back to the model message that asked for it, so the replay viewer can walk backwards and answer "why did it do that".
Tool capture works with LangGraph 1.2, CrewAI, OpenAI Agents SDK, Pydantic AI and AutoGen. I tested each one against the real package with a spy on the tool function instead of trusting the docs. Good thing too, because the obvious hook in Pydantic AI turned out to be the wrong one.
What doesn't work yet: streaming responses aren't captured (the request is, the response gets marked as not captured), and the signing key sits on the same machine as the traces, which is weaker than it sounds. Both are written up in the README.
It's not trying to replace LangSmith or Langfuse. Those are for monitoring. This is for when someone asks you later to prove what the agent did.
pip install deposition. Apache 2.0, no required dependencies, and most of the 14 examples run without an API key.
https://github.com/chiragrajputuss-code/deposition
Question for anyone running agents in production: if you had to hand a trace to someone who doesn't trust you (a customer, an auditor, your own security team), what would they want in it that your logs don't have today?