The flight recorder for autonomous AI agents. Record, replay, enforce, audit — with tamper-evident evidence built for someone else to check.

When a regulator, client, or candidate asks what your AI did, "trust our logs" is not an answer. AIR writes every agent decision to a tamper-evident chain and countersigns the history with an external timestamp authority — a key neither you nor your application holds. You can still lie. You just can't do it invisibly.

pip install air-blackbox
air-blackbox comply --scan . -v

A full scan runs 58 checks: 39 against EU AI Act Articles 9, 10, 11, 12, 14 and 15, plus GDPR, bias/fairness, and US state AI law — Colorado SB 26-189, Illinois HB 3773, California FEHA ADS rules, NYC LL144. An ISO 42001 and NIST AI RMF crosswalk ships as an importable mapping.

This is not a certified compliance test. The checks are heuristic static detectors and a starting point for finding gaps.

Nothing is recorded until traffic runs through the AIR Gateway. One proxy swap; the rest of your code is unchanged.

client = OpenAI(
    base_url="http://localhost:8080/v1",
    default_headers={"X-Gateway-Key": "your-key"},
)

export TRUST_SIGNING_KEY="$(openssl rand -hex 32)"   # without this the chain uses a public development key
air-blackbox discover             # find undeclared model calls
air-blackbox replay --verify      # recompute the chain
air-blackbox export --format evidence   # self-verifying ZIP with a standalone verify.py

An audit log the operator controls is testimony, not evidence. AIR separates the three things an auditor actually needs:

• Integrity — HMAC-SHA256 chaining: alter any record and verification fails at that record and at every record after it. Set TRUST_SIGNING_KEY; the built-in development default is a public constant and gives you ordering, not forgery resistance. air-blackbox comply reports its absence as a finding.
• Authorship — Gate- and MCP-recorded actions carry a signed receipt. Ed25519 by default; install the pqc extra (pip install "air-blackbox[pqc]") and ML-DSA-65 — NIST's standardized post-quantum signature — becomes the default for new signing identities, because signatures generated today must outlive the retention window of the records they protect.
• History — the chain head is countersigned by an external RFC 3161 timestamp authority and optionally published to a public transparency log. A rewritten, re-signed history no longer matches the timestamp — that's the check that catches the operator, not just an outsider.

Two evidence formats, and the difference matters. The CLI's export --format evidence writes a ZIP with a standalone verify.py; your auditor runs it with your signing key. Bundles exported through the AIR MCP server are .air-evidence v1: the manifest is signed with Ed25519 or ML-DSA-65, RFC 3161 anchoring is available, and air-evidence verify runs six ordered checks with no secret at all — which is the only form of this that a third party can check without you handing over a key.

Self-hosted, keys are generated locally and never leave your machine. The hosted connector generates and stores per-tenant keys on AIR's infrastructure — the tradeoff for governance inside claude.ai, and the reason the external countersignature matters most there.

Trust layers for LangChain, CrewAI, the OpenAI SDK, Anthropic Claude Agent SDK, Google ADK, AutoGen, and Haystack. Same audit chain, native integration.

git clone https://github.com/airblackbox/air-platform.git
cd air-platform && make up    # first run pulls four images and builds the collector

• airblackbox.ai — website and docs
• airblackbox.ai/console — hosted console; the free scanner runs at /console/scan
• airblackbox.ai/demo — interactive demos. The operator-rewrite catch is a runnable script: python demo/hiring_audit_day.py
• PyPI

Apache 2.0. EU AI Act Annex III high-risk obligations: 2 December 2027 — the delay moves the audit date, not the evidence problem.