Provara

Why Your AI Agent's Memory Needs Cryptographic Proof

The verifiability gap between standard MCP Memory Servers and Provara's cryptographic event log.

The Problem: AI Agents Can't Trust Their Own Memory

You're building an AI agent that:

Question: How do you know your agent's memory hasn't been tampered with?

Most MCP Memory Servers store data in a database or vector store. The agent queries: "What did the user tell me last week?" The database returns results. The agent trusts them.

But what if:

With standard MCP Memory, there's no way to detect these issues. The memory layer has no integrity guarantees.

The Standard Approach: MCP Memory Server

A typical MCP Memory Server exposes tools like:


{
  "name": "write_memory",
  "arguments": {
    "content": "User prefers dark mode",
    "tags": ["preference", "ui"]
  }
}

Under the hood:


def write_memory(content: str, tags: list):
    db.insert({
        "content": content,
        "tags": tags,
        "timestamp": datetime.now().isoformat()
    })

The trust model:

This is fine for:

This is NOT fine for:

The Provara Approach: Cryptographic Event Log

Provara replaces the database with a tamper-evident event log:


{
  "name": "append_event",
  "arguments": {
    "vault_path": "/path/to/vault",
    "event_type": "OBSERVATION",
    "data": {
      "subject": "user_preference",
      "predicate": "ui_theme",
      "value": "dark_mode"
    }
  }
}

Under the hood:


def append_event(vault, event_type, data):
    # 1. Build event
    event = {
        "type": event_type,
        "actor": "agent_01",
        "prev_event_hash": get_last_hash(),
        "timestamp_utc": datetime.now(timezone.utc).isoformat(),
        "payload": data
    }
    
    # 2. Content-addressed ID
    event["event_id"] = "evt_" + sha256(canonical_json(event))[:24]
    
    # 3. Sign with Ed25519
    event["sig"] = ed25519_sign(event, private_key)
    
    # 4. Append to NDJSON log
    events_file.write(canonical_dumps(event) + "\n")
    
    # 5. Verify chain integrity
    assert verify_chain(vault)  # Raises if broken

The trust model:

Concrete Scenario: The Disputed Recommendation

Setup

Two AI agents, Alice-Bot and Bob-Bot, coordinate investment recommendations for a hedge fund. They share a Provara vault.

Day 1:

Both events are signed and appended to the shared vault.

Day 30:

The fund lost money on NVDA. Compliance investigates: "Who made the BUY recommendation?"

With Standard MCP Memory

Compliance asks: "Show me the NVDA recommendation from Day 1."

System returns: NVDA:recommendation = "HOLD" (Bob's view — Alice's was overwritten)

Result: Alice is blamed for a recommendation she didn't make. The database's last-write-wins semantics erased the truth.

With Provara MCP Memory

Compliance asks: "Show me the NVDA recommendation from Day 1."

System returns:


{
  "contested": {
    "NVDA:recommendation": {
      "status": "AWAITING_RESOLUTION",
      "evidence_by_value": {
        "\"BUY\"": [
          {
            "event_id": "evt_abc123",
            "actor": "alice_bot",
            "timestamp_utc": "2026-02-01T14:32:00Z",
            "signature": "WwJUs21oN2+4eWOh..."
          }
        ],
        "\"HOLD\"": [
          {
            "event_id": "evt_def456",
            "actor": "bob_bot",
            "timestamp_utc": "2026-02-01T14:35:00Z",
            "signature": "pR0+mb2G6DtCgKgn..."
          }
        ]
      }
    }
  }
}

Result: The conflict is visible. Compliance requests attestation from the oracle node. The oracle reviews both recommendations against market data and attests: "Alice's BUY was correct per the strategy doc." The dispute is resolved, and the canonical record reflects the truth.

Key difference: Provara doesn't hide conflicts — it surfaces them for resolution.

The Verifiability Gap

Property Standard MCP Memory Provara MCP Memory
Integrity Trust the database SHA-256 hash chains
Tamper detection None (silent corruption) Immediate (chain breaks)
Non-repudiation None (anonymous writes) Ed25519 signatures
Conflict handling Last-write-wins (data loss) Contested namespace (preserved)
Temporal proof System clock (untrusted) RFC 3161 TSA (independent)
Audit trail Database logs (mutable) Event log (immutable)
State derivation Opaque (database internals) Deterministic reducer
Long-term format Database schema (drift) NDJSON (50-year readability)

When Does This Matter?

It Doesn't Matter If:

It Does Matter If:

Real-World Use Cases

1. AI Hedge Fund

Problem: Multiple agents generate trading signals. Disagreements are common. Compliance requires an audit trail.

Provara solution:

Problem: Law firm needs to preserve evidence chain for litigation. Opposing counsel may challenge authenticity.

Provara solution:

3. Supply Chain Provenance

Problem: Multiple parties (supplier, manufacturer, shipper, retailer) record events. Disputes arise over responsibility.

Provara solution:

4. AI Research Reproducibility

Problem: Research team runs thousands of experiments. Need to prove which hyperparameters produced which results.

Provara solution:

The Cost of Verifiability

Performance:

Overhead:

Storage:

The tradeoff: Provara is 10x slower and 2.5x larger, but provides cryptographic guarantees that databases cannot.

Getting Started

Option 1: Self-Hosted Provara MCP Server


# Install
pip install provara-protocol

# Create vault
provara init agent_memory --actor "my_agent" --private-keys keys.json

# Run MCP server
python tools/mcp_server/server.py --transport stdio

Configure your MCP host (Claude Desktop, Cursor, etc.) to use the Provara server instead of a standard memory server.

Option 2: Hybrid Approach

Use both:

This gives you performance for common cases and verifiability for high-stakes events.

The Bottom Line

If your AI agent's decisions matter, its memory must be verifiable.

Standard MCP Memory Servers are fine for note-taking. But for multi-agent coordination, regulated industries, or high-stakes decisions, you need cryptographic proof that memory is intact.

Provara provides:

The question isn't "Can I afford to use Provara?" It's "Can I afford not to?"

Next steps:

Provara is open-source under Apache 2.0. Built by the Provara team.