Start here

AFA Protocol documentation

An agent acted at 03:12. Weeks later someone asks who allowed it. These pages cover the hosted API, the MCP transport and the console: how to record what an agent did and was allowed to do, and how to check that record later without asking us. Read the limits first.

LimitsWhat the record cannot show, stated first. Seven limits, each with the check that demonstrates it.QuickstartSign in with an email code, create a key, write the first record, check it, connect a host over MCP.AuthenticationSession cookie for the console and key management. Per-machine key for agents. What each one can and cannot do.API reference110 operations across 28 groups. Each with curl, Python, an example response, errors, and its check.MCPOne remote endpoint over HTTP. Config for Claude Code and Cursor. The tool table with what each tool does.SurfacesREST, hosted MCP, the console, and the operator tools that are not a customer surface.Local ledgerA SQLite file your process appends to, hashes not payloads, with two verifiers and a reconcile step.WebhooksQueued, retried delivery of authority changes. Read the signature section before relying on the header.VerifyOffline verification of delegation tokens with the pinned service key, and the hosted record checks.ChangelogDated entries. Newest first.

Hosts

Host	What answers there
https://api.afaprotocol.com	The REST API and the MCP endpoint. GET /v1/health reports status and storage.
https://app.afaprotocol.com	The console. Email sign-in, keys, records, grants, notifications.
https://app.afaprotocol.com/docs/	These pages.
https://afaprotocol.com	The public site.

What a record holds

Each event carries an id, a type, a sequence number, the hash of the previous event, a payload hash, an optional signature, a machine id and a timestamp. The reference clients never send the prompt, the tool output or a secret, and the API adds none. The check: GET /v1/events/{event_id} on your own account.

Worked example

sequence 41   2026-08-31T14:12:07+00:00   tool_call   decision=allow   tool=deploy
  payload_hash  sha256:9b3f5c0e2d8a71c4f6e1b0a9d2c3e4f5061728394a5b6c7d8e9f0a1b2c3d4e5f
  prev_hash     sha256:4c1d9e7a2b3f6058c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f60718293a4b5c6d7e
  machine       worker-1     signature ed25519:...   grant g-0c9f31ab7e2d (expires 2026-08-31T18:00:00+00:00)

What you can show: the action ran at 14:12:07, under a grant issued that morning
and scoped to four tools, and the record has not changed since it was written.
What you cannot show: that deploying was the right call.