App and SDK

Exalto Capture

What it is

The flight recorder for your AI work

For agents

capture.exalto.ai/llms.txt

Overview

001

Sometimes the exchange itself is the evidence.

Exalto Capture · You capture. A third party seals. Anyone can verify.

What an agent did, what a chatbot told you, what a paid API returned. Capture it on your side as it happens. Seal it. Anyone can verify.

Download Exalto Capture Read the docs

Verify a trace ↗

macOS 12+ on Apple silicon · CLI for macOS and Linux

Fig. 01An eval run, on the record.Example trace replay · 15 Oct 2026

~/evalszshREC

$capture status

service running · proxy 127.0.0.1:8787 · admin 127.0.0.1:8788

notary Exalto Seal

capture on

$export OPENAI_BASE_URL=http://127.0.0.1:8787/openai/v1

$python run_eval.py --suite reasoning-50 --model gpt-5

50/50 items · 43 correct · 50 exchanges captured

$capture traces list --query "Item 37" --metadata-only

trc-8f3k2q openai gpt-5 200 14:03:52 captured

$capture traces seal trc-8f3k2q --wait

queued · running · authenticated transcript 6.2 KB

commitments 6/6 · succeeded

wrote trc-8f3k2q.llmtrace

$capture traces verify trc-8f3k2q

✓provenance api.openai.com over authenticated TLS

✓integrity package hashes match

✓time witnessed by Exalto Seal at 14:03:52 UTC

Sealed traceVerified

trc-8f3k2q

reasoning-50 · Item 37 · openai · gpt-5

Provenanceapi.openai.com · authenticated TLS✓

Integritysha256 9c41…e07b · 6 entries✓

Time14:03:52 UTC · Exalto Seal✓

DisclosedRequest and response bodiesHiddenEvery header value, your API key includedNotaryExalto Seal · key 02a7…c41e

Verified against the Exalto Seal’s public key. Anyone can verify.

seal.exalto.ai/trc-8f3k2q

A benchmark run through the local service. The harness keeps its API key, every exchange lands in your archive, and the one you cite gets sealed.

Log 002The flight recorder#recorder

Exalto Capture is the flight recorder for your AI work. Start it, point Claude Code, Codex, or your own tools at it, and every session is recorded on your machine, witnessed by the third-party "notary" (e.g. Exalto Seal) you select at setup. Nobody looks at it in normal operation. When something needs proof, seal the trace and hand it to anyone. Until that day, it’s just a folder on your computer that nobody, including the notary, can read.

Who it is for: Developers who ship agents, run evals, route models or sell tool calls, and anyone who wants a record of their AI work that other people can verify.
Why now: As agents take on more of the work, customers, reviewers, auditors and counterparties will ask how a result was produced. Exalto Capture makes that evidence simple to keep, share and verify, whether you ship agents or sign off on their work.
Pricing: Local capture is free, always. You pay for what you seal.

FIG. 260Instructions62Responses64Tool calls66TimeDesign for a flying machine, after Leonardo

Log 003How it works#how-it-works

A transcript or screenshot can be edited. A sealed trace is actual proof.

Anyone can edit a transcript or alter a screenshot. That’s why “here’s what the AI said” cannot be trusted.

Your session already runs over an encrypted, authenticated connection to the AI provider. The protocol relays that session through an independent "notary" (e.g. Exalto Seal) that witnesses exactly what crossed the wire without ever being able to read it. Using multiparty TLS, your machine and the notary split the session keys so the notary co-signs the encrypted traffic in real time without holding the decryption key, and when you selectively disclose an exchange later, the math proves it came from the provider while keeping your API keys and unshared work completely private. Old cryptography, pointed at a pressing new problem.

FIG. 370You72The notary74The AI provider76AnyoneMultiparty TLS, built on TLSNotary

A sealed trace establishes

Provenance

It came from a specific AI provider.

Integrity

It hasn’t been altered.

Time

It existed by that moment.

Nothing readable ever leaves your machine. Nobody, including us, sees your work. The cryptography is TLSNotary, open source. More in the spec.

Fig. 04Disclose the exchange you want to share. Keep the rest.Interactive · reasoning-50

Your archive · 50 exchanges3 disclosed · 47 private

DisclosedPrivateSelected

Click an exchange to disclose and inspect it; click it again to keep it private. The notary saw ciphertext for all fifty. Disclosing three reveals three.

Item 37 · reasoning-50Disclosed

trc-8f3k2q

Request · request.disclosed.http

POST /v1/responses HTTP/1.1

host:

authorization:

content-type:

{"model":"gpt-5","input":"Item 37. What is 49 × 8?"}

Response · response.disclosed.http

HTTP/1.1 200 OK

content-type:

transfer-encoding: chunked

{"output_text":"392"}

Provenanceapi.openai.com · authenticated TLS✓

Integritypackage hashes match✓

Time14:03:52 UTC · Exalto Seal✓

capture traces verify trc-8f3k2q · passes

Header values are hidden in every sealed trace, so your API key never travels. Request and response bodies are what you can choose to disclose.

Log 004Quickstart#quickstart

From install to a sealed trace.

Keep the API key in your client and replace only its base URL. The local service relays the call, records it, and keeps the private checkpoint on your machine.

01
Install the CLI and local service
Apple silicon macOS or Linux. Prefer a guided setup? Download the desktop app.
$ curl -fsSL https://capture.exalto.ai/install.sh | sh
02
Start the local service
Provider proxy on 127.0.0.1:8787; dashboard and API on 127.0.0.1:8788. Capture is on by default.
$ captured
03
Point your client at it
Routes for OpenAI, Anthropic, Codex, DeepSeek and OpenRouter are on from the first start.
$ export OPENAI_BASE_URL=http://127.0.0.1:8787/openai/v1
04
Find the call
Lists what was recorded without decrypting a single checkpoint.
$ capture traces list --provider openai --limit 20
05
Seal it
Exalto Seal commits one portable .llmtrace package. Sealing is the only thing you pay for.
$ capture traces seal trc-8f3k2q --wait
06
Verify it
Verifies the notary evidence, the provider’s identity, the disclosed bytes and every hash. Anyone holding the package can run it.
$ capture traces verify trc-8f3k2q

Claude Code: ANTHROPIC_BASE_URL=http://127.0.0.1:8787/anthropic claude. Codex CLI uses the fixed /codex route. Every route is in the docs.

Log 005The components of the stack#components

The Exalto Capture Stack

Exalto Capture Desktop App

The flight recorder. Record your AI exchanges as they happen, on your machine. Start it and after the initial setup work normally; every session lands here, on your machine. Free, always.

Anyone with Claude Code, Codex, a chatbot or their own tools

Exalto Capture SDK and CLI

Build the flight recorder into your own products and services: capture, seal and verify from your code. The spec, the OpenTelemetry trace format and the offline verifier are all open source. The docs.

Developers, routers, eval and security teams

Exalto Seal, the "notary"

Binds a trace to the provider, the time and the content, so anyone can verify it later. Share a link, and anyone can verify it too. The third party that countersigns and timestamps, and never sees plaintext. Sealing is the only thing you pay for; sealed traces and docs live at seal.exalto.ai.

Everyone

The Exalto Capture Protocol (ECP)

The open protocol underneath all of it. Use Exalto’s Seal notary or run your own.

Operators of compatible notaries; builders

An open protocol. A choice of who to seal with.

One open standard at the base. Tools, notaries, and apps stack on top. Exalto Seal is just one notary among many: seal with ours, with a third party’s, or with one you run for your organization.

Yours to build.

Sealed traces are a new primitive. The spec, the OpenTelemetry trace format, and the verifier are open.

→ build on the protocol

Fig. 05Inside a sealed trace..llmtrace · six entries, in order

trc-8f3k2q.llmtrace

├── archive-manifest.json80The formats, then the path, size and SHA-256 of every entry.

├── evidence.tlsn82The TLSNotary presentation, the notary’s signature and the provider’s TLS identity.

├── manifest.json84The trace ID, the authenticated provider and host, the connection time and the notary key.

├── request.disclosed.http86What was sent: the request line, header names and body. Every header value is hidden.

├── response.disclosed.http88What came back: output, usage and tool calls, as the provider sent them.

└── trace.otlp.json90The same exchange as a canonical OpenTelemetry trace.

Log 006Applications#applications

Sealed traces lower the cost of verification.

Cheap verification changes behavior and increases trust.

Traces for AI R&D, evaluation and investigation

Give others evidence they can verify.

Researchers, builders and independent evaluators need to rely on traces from work they did not run themselves.

The Exalto Capture CLI lets you capture and seal model requests and responses. Share the relevant run without opening your entire archive. Anyone can verify the origin and integrity of the disclosed exchanges.

Back a benchmark result with the model, prompts and responses behind it. Publish an agent paper with traces reviewers can inspect. Give an outside investigator verifiable exchanges from a disputed run.

In cybersecurity, this is how defenders learn: the instructions a model received, the responses it produced, the tool calls it requested. Sealed, those records can go to other teams without asking them to trust the source.

Post by clem (@ClementDelangue) on X, 8 Oct 2026: We urgently need more public traces of AI agents attacking and defending systems. Defenders can’t learn from what they can’t see. If you have traces and are being pressured to keep them private, my DMs are open. Let’s level the playing field and fight the asymmetry and lack of transparency in AI! — x.com/ClementDelangue/status/2108184948548976921 ↗

Commit, then verify

Commit to the record before an incident. Verify it afterward.

Publish a commitment to a defined set of traces on a regular schedule. Investigators can later check the disclosed records against that commitment and spot anything changed or missing from the committed set.

The labs currently control disclosure. Reviewers can independently check whether the disclosed evidence matches the earlier commitment.

Receipts for model routing and agentic commerce

Receipts for what was served and what was delivered.

Customers choose a provider and model configuration. Routers can use Exalto to seal the upstream exchange and link it to the customer’s request. The proof ties the response, including any reported configuration, to the provider’s authenticated endpoint.

When an agent pays for a tool call over x402 or MPP, give both sides verifiable evidence of what came back. Seal the request and response, then link the dated exchange to the payment receipt. Buyers and sellers now have a record they can use in a dispute.

The same applies to a shopping agent acting on a user’s mandate: connect the authorization, merchant terms and order confirmation to show what was approved, what was ordered and what was confirmed.

The audited commit

Provenance per commit, checkable by anyone with access.

A pull request lands with a coding agent behind it. Change controls already require proof that someone reviewed it; with agents writing the code, the proof has to show what the human checked. The developer seals the session and links it from the commit: what the agent was asked, what it changed, what the developer verified. Provenance per commit, checkable by anyone with access. The same record answers a regulator or third-party years later, across every commit rather than a sample.

Works with Codex and Claude Code today.

More usesthe published evalprompt-injection forensics

Log 007Trust model#trust

One trace proves what happened. Capture enforced across an organization also proves what didn’t.

A sealed trace proves

It cannot prove

The disclosed bytes traveled an authenticated connection with the named AI provider.

On its own, that every interaction was disclosed. With capture enforced across an organization, it can.

They have not changed since capture.

Who was behind the keyboard.

The named "notary" service witnessed them at the stated time.

On its own, that no other AI or device was used. Enforced capture closes that gap too.

The exact timeline as it actually unfolded.

That an output was correct, lawful, or wise.

A trace covers the interactions you capture, and for most uses that is what matters. Where completeness matters, enforce capture across the organization: then the record also shows what never happened.

Learn more: full trust model

Log 008For agents#agents

Hand this to your agent.

Paste it into Claude Code, Codex, or any agent with a shell. It installs Capture, adds the skill, and asks before it seals or shares anything.

Prompt

Set up Exalto Capture on this machine. Read https://capture.exalto.ai/llms.txt first.Install the CLI: curl -fsSL https://capture.exalto.ai/install.sh | shAdd the skill: capture skill install --target allStart the local service: capturedCheck it: capture --json statusAsk me before you seal a trace, connect an account, or share anything.

capture.exalto.ai/llms.txt

This page, written for agents: what Capture does, the trust boundary, install, and the package layout.

capture.exalto.ai/docs.md

Every page has a markdown twin. Add .md to the address.

capture skill install --target all

The bundled Agent Skill teaches Claude Code and Codex to find captures, seal selected calls, verify traces, and ask before anything state-changing or public.

127.0.0.1:8788/openapi.json

The local service publishes its OpenAPI 3.1 contract. Add --json to any command.

capture.exalto.ai/docs/agents

The procedure, step by step, with the command and the field that proves each step worked, and what to ask before.

Log 009Powered by Capture#proof-of-thought

Proof of Thought.

A scratchpad for thinking and editing with AI that shows what you contributed and what the model did. Every scratchpad has a flight recorder underneath; its seals come from Seal.

→ proof.exalto.ai

Captured by

You

Sealed by

Exalto Seal

Verified by

Anyone