# Sometimes the exchange itself is the evidence. > The flight recorder for your AI work. Capture your sessions on your machine, have a third party seal the ones you need to show, and let anyone verify them. The desktop app, the SDK and CLI, and the open protocol underneath. This is capture.exalto.ai as Markdown. The docs index is https://capture.exalto.ai/llms.txt; the whole site in one file is https://capture.exalto.ai/llms-full.txt; the page for agents is https://capture.exalto.ai/docs/agents.md. Exalto Capture · You capture. A third party seals. Anyone can verify. What an agent did, what a chatbot told you, what a paid API returned. Capture it on your side as it happens. Seal it. Anyone can verify. [Download Exalto Capture](https://capture.exalto.ai/docs/getting-started) · [Read the docs](https://capture.exalto.ai/docs) [Verify a trace ↗](https://seal.exalto.ai/verify) macOS 12+ on Apple silicon · CLI for macOS and Linux *Fig. 01 · An eval run, on the record. · Example trace replay · 15 Oct 2026* ```text $ capture status service running · proxy 127.0.0.1:8787 · admin 127.0.0.1:8788 notary Exalto Seal capture on $ export OPENAI_BASE_URL=http://127.0.0.1:8787/openai/v1 $ python run_eval.py --suite reasoning-50 --model gpt-5 50/50 items · 43 correct · 50 exchanges captured $ capture traces list --query "Item 37" --metadata-only trc-8f3k2q openai gpt-5 200 14:03:52 captured $ capture traces seal trc-8f3k2q --wait queued · running · authenticated transcript 6.2 KB commitments 6/6 · succeeded wrote trc-8f3k2q.llmtrace $ capture traces verify trc-8f3k2q ✓ provenance api.openai.com over authenticated TLS ✓ integrity package hashes match ✓ time witnessed by Exalto Seal at 14:03:52 UTC $ ``` The receipt beside it moves from Recording to Captured to Sealed to Verified: trace trc-8f3k2q, provenance api.openai.com over authenticated TLS, integrity sha256 9c41…e07b over 6 entries, time 14:03:52 UTC witnessed by Exalto Seal; request and response bodies disclosed, every header value hidden; link seal.exalto.ai/trc-8f3k2q. A benchmark run through the local service. The harness keeps its API key, every exchange lands in your archive, and the one you cite gets sealed. Exalto Capture is the flight recorder for your AI work. Start it, point Claude Code, Codex, or your own tools at it, and every session is recorded on your machine, witnessed by the third-party "notary" (e.g. Exalto Seal) you select at setup. Nobody looks at it in normal operation. When something needs proof, seal the trace and hand it to anyone. Until that day, it’s just a folder on your computer that nobody, including the notary, can read. **Who it is for:** Developers who ship agents, run evals, route models or sell tool calls, and anyone who wants a record of their AI work that other people can verify. **Why now:** As agents take on more of the work, customers, reviewers, auditors and counterparties will ask how a result was produced. Exalto Capture makes that evidence simple to keep, share and verify, whether you ship agents or sign off on their work. **Pricing:** Local capture is free, always. You pay for what you seal. Fig. 2: Leonardo da Vinci's design for a flying machine, with callouts 60 Instructions, 62 Responses, 64 Tool calls, 66 Time. ## A transcript or screenshot can be edited. A sealed trace is actual proof. Anyone can edit a transcript or alter a screenshot. That’s why “here’s what the AI said” cannot be trusted. Your session already runs over an encrypted, authenticated connection to the AI provider. The protocol relays that session through an independent "notary" (e.g. Exalto Seal) that witnesses exactly what crossed the wire without ever being able to read it. Using multiparty TLS, your machine and the notary split the session keys so the notary co-signs the encrypted traffic in real time without holding the decryption key, and when you selectively disclose an exchange later, the math proves it came from the provider while keeping your API keys and unshared work completely private. Old cryptography, pointed at a pressing new problem. Fig. 3, the relay: 01 Start a session (70 You: Exalto Capture on your machine; holds the key and plaintext). 02 Witness, never read (72 The notary: Exalto Seal, or one you run; holds one key share). 03 Answer as usual (74 The AI provider: api.openai.com, api.anthropic.com; serves TLS as usual). One authenticated TLS session; the notary co-signs ciphertext only. 04 Verify, anywhere (76 Anyone: seal.exalto.ai, or offline; needs the notary key). Later, you hand over the sealed trace; only what you disclose travels. Multiparty TLS, built on TLSNotary. **A sealed trace establishes** ### Provenance It came from a specific AI provider. ### Integrity It hasn’t been altered. ### Time It existed by that moment. Nothing readable ever leaves your machine. Nobody, including us, sees your work. The cryptography is [TLSNotary](https://tlsnotary.org/), open source. More in the [spec](https://capture.exalto.ai/docs). *Fig. 04 · Disclose the exchange you want to share. Keep the rest. · Interactive · reasoning-50* Interactive demo: an archive of 50 exchanges, three of them disclosed. Disclosing one shows its request.disclosed.http (every header value hidden, body in the clear) and response.disclosed.http, with Provenance, Integrity and Time checks; changing one byte of the answer fails the integrity check. Header values are hidden in every sealed trace, so your API key never travels. Request and response bodies are what you can choose to disclose. ## From install to a sealed trace. Keep the API key in your client and replace only its base URL. The local service relays the call, records it, and keeps the private checkpoint on your machine. ### 01 Install the CLI and local service Apple silicon macOS or Linux. Prefer a guided setup? [Download the desktop app](https://capture.exalto.ai/docs/getting-started). ```sh curl -fsSL https://capture.exalto.ai/install.sh | sh ``` ### 02 Start the local service Provider proxy on 127.0.0.1:8787; dashboard and API on 127.0.0.1:8788. Capture is on by default. ```sh captured ``` ### 03 Point your client at it Routes for OpenAI, Anthropic, Codex, DeepSeek and OpenRouter are on from the first start. ```sh export OPENAI_BASE_URL=http://127.0.0.1:8787/openai/v1 ``` ### 04 Find the call Lists what was recorded without decrypting a single checkpoint. ```sh capture traces list --provider openai --limit 20 ``` ### 05 Seal it Exalto Seal commits one portable .llmtrace package. Sealing is the only thing you pay for. ```sh capture traces seal trc-8f3k2q --wait ``` ### 06 Verify it Verifies the notary evidence, the provider’s identity, the disclosed bytes and every hash. Anyone holding the package can run it. ```sh capture traces verify trc-8f3k2q ``` Claude Code: `ANTHROPIC_BASE_URL=http://127.0.0.1:8787/anthropic claude`. Codex CLI uses the fixed /codex route. Every route is in [the docs](https://capture.exalto.ai/docs/getting-started). ## The Exalto Capture Stack ### Exalto Capture Desktop App The flight recorder. Record your AI exchanges as they happen, on your machine. Start it and after the initial setup work normally; every session lands here, on your machine. Free, always. Anyone with Claude Code, Codex, a chatbot or their own tools ### Exalto Capture SDK and CLI Build the flight recorder into your own products and services: capture, seal and verify from your code. The spec, the OpenTelemetry trace format and the offline verifier are all open source. [The docs](https://capture.exalto.ai/docs). Developers, routers, eval and security teams ### Exalto Seal, the "notary" Binds a trace to the provider, the time and the content, so anyone can verify it later. Share a link, and anyone can verify it too. The third party that countersigns and timestamps, and never sees plaintext. Sealing is the only thing you pay for; sealed traces and docs live at seal.exalto.ai. Everyone ### The Exalto Capture Protocol (ECP) The open protocol underneath all of it. Use Exalto’s Seal notary or run your own. Operators of compatible notaries; builders ### An open protocol. A choice of who to seal with. One open standard at the base. Tools, notaries, and apps stack on top. Exalto Seal is just one notary among many: seal with ours, with a third party’s, or with one you run for your organization. ### Yours to build. Sealed traces are a new primitive. The spec, the OpenTelemetry trace format, and the verifier are open. [→ build on the protocol](https://capture.exalto.ai/docs) *Fig. 05 · Inside a sealed trace. · .llmtrace · six entries, in order* `trc-8f3k2q.llmtrace` - `archive-manifest.json` (80): The formats, then the path, size and SHA-256 of every entry. - `evidence.tlsn` (82): The TLSNotary presentation, the notary’s signature and the provider’s TLS identity. - `manifest.json` (84): The trace ID, the authenticated provider and host, the connection time and the notary key. - `request.disclosed.http` (86): What was sent: the request line, header names and body. Every header value is hidden. - `response.disclosed.http` (88): What came back: output, usage and tool calls, as the provider sent them. - `trace.otlp.json` (90): The same exchange as a canonical OpenTelemetry trace. ## Sealed traces lower the cost of verification. Cheap verification changes behavior and increases trust. ### Traces for AI R&D, evaluation and investigation Give others evidence they can verify. Researchers, builders and independent evaluators need to rely on traces from work they did not run themselves. The Exalto Capture CLI lets you capture and seal model requests and responses. Share the relevant run without opening your entire archive. Anyone can verify the origin and integrity of the disclosed exchanges. Back a benchmark result with the model, prompts and responses behind it. Publish an agent paper with traces reviewers can inspect. Give an outside investigator verifiable exchanges from a disputed run. In cybersecurity, this is how defenders learn: the instructions a model received, the responses it produced, the tool calls it requested. Sealed, those records can go to other teams without asking them to trust the source. Clément Delangue (@ClementDelangue) on X, 8 Oct 2026: “We urgently need more public traces of AI agents attacking and defending systems. Defenders can’t learn from what they can’t see. If you have traces and are being pressured to keep them private, my DMs are open. Let’s level the playing field and fight the asymmetry and lack of transparency in AI!” https://x.com/ClementDelangue/status/2108184948548976921 **Commit, then verify** Commit to the record before an incident. Verify it afterward. Publish a commitment to a defined set of traces on a regular schedule. Investigators can later check the disclosed records against that commitment and spot anything changed or missing from the committed set. The labs currently control disclosure. Reviewers can independently check whether the disclosed evidence matches the earlier commitment. ### Receipts for model routing and agentic commerce Receipts for what was served and what was delivered. Customers choose a provider and model configuration. Routers can use Exalto to seal the upstream exchange and link it to the customer’s request. The proof ties the response, including any reported configuration, to the provider’s authenticated endpoint. When an agent pays for a tool call over x402 or MPP, give both sides verifiable evidence of what came back. Seal the request and response, then link the dated exchange to the payment receipt. Buyers and sellers now have a record they can use in a dispute. The same applies to a shopping agent acting on a user’s mandate: connect the authorization, merchant terms and order confirmation to show what was approved, what was ordered and what was confirmed. ### The audited commit Provenance per commit, checkable by anyone with access. A pull request lands with a coding agent behind it. Change controls already require proof that someone reviewed it; with agents writing the code, the proof has to show what the human checked. The developer seals the session and links it from the commit: what the agent was asked, what it changed, what the developer verified. Provenance per commit, checkable by anyone with access. The same record answers a regulator or third-party years later, across every commit rather than a sample. Works with Codex and Claude Code today. More uses · the published eval · prompt-injection forensics ## One trace proves what happened. Capture enforced across an organization also proves what didn’t. | A sealed trace proves | It cannot prove | | --- | --- | | The disclosed bytes traveled an authenticated connection with the named AI provider. | On its own, that every interaction was disclosed. With capture enforced across an organization, it can. | | They have not changed since capture. | Who was behind the keyboard. | | The named "notary" service witnessed them at the stated time. | On its own, that no other AI or device was used. Enforced capture closes that gap too. | | The exact timeline as it actually unfolded. | That an output was correct, lawful, or wise. | A trace covers the interactions you capture, and for most uses that is what matters. Where completeness matters, enforce capture across the organization: then the record also shows what never happened. Learn more: [full trust model](https://capture.exalto.ai/docs/how-it-works) ## Hand this to your agent. Paste it into Claude Code, Codex, or any agent with a shell. It installs Capture, adds the skill, and asks before it seals or shares anything. ```text Set up Exalto Capture on this machine. Read https://capture.exalto.ai/llms.txt first. Install the CLI: curl -fsSL https://capture.exalto.ai/install.sh | sh Add the skill: capture skill install --target all Start the local service: captured Check it: capture --json status Ask me before you seal a trace, connect an account, or share anything. ``` - [capture.exalto.ai/llms.txt](https://capture.exalto.ai/llms.txt): This page, written for agents: what Capture does, the trust boundary, install, and the package layout. - `capture.exalto.ai/docs.md`: Every page has a markdown twin. Add .md to the address. - `capture skill install --target all`: The bundled Agent Skill teaches Claude Code and Codex to find captures, seal selected calls, verify traces, and ask before anything state-changing or public. - `127.0.0.1:8788/openapi.json`: The local service publishes its OpenAPI 3.1 contract. Add --json to any command. - [capture.exalto.ai/docs/agents](https://capture.exalto.ai/docs/agents): The procedure, step by step, with the command and the field that proves each step worked, and what to ask before. ## Proof of Thought. A scratchpad for thinking and editing with AI that shows what you contributed and what the model did. Every scratchpad has a flight recorder underneath; its seals come from Seal. [→ proof.exalto.ai](https://proof.exalto.ai/) **Captured by** You · **Sealed by** Exalto Seal · **Verified by** Anyone Capture. Seal. Verify.