What happened
AgentAudit's npm package page lists @agentauditai/mcp-server version 3.0.0 as a public release. AgentAudit describes it as an MCP server for Claude, Cursor and other MCP clients over stdio, intended for on-chain audit logging and incident records. The package says its records can support EU AI Act record-keeping, while explicitly warning that the tools do not determine whether any legal obligation is satisfied.
The server exposes three action-audit tools against AuditVault v2 on Base. audit_action writes one or more agent actions in a single commitBatch transaction; get_audit_log reads committed batches; and verify_proof checks whether an entry is included. audit_action accepts an agent identifier, entries, an optional agent address, a 0–100 compliance score, and a network setting that defaults to Base. Entries include an action type and payload, with an optional risk level and timestamp.
AgentAudit says an action payload is SHA-256 hashed, with JCS used for object payloads, and that raw content does not leave the process. Each entry becomes an Evidence Schema v1 preimage. The call returns a transaction hash, batch index, Merkle root, entry references and proofs, plus a full evidence bundle. AgentAudit says that bundle must be kept because the batch payload is not stored elsewhere; the recorded content URI is memory://<root>. Each call commits immediately rather than buffering entries between calls. The npm page lists the Base AuditVault v2 address as 0xCeE831070aa9081422f30df5559c125aa47A75DB.
Separate incident-recording tools write to IncidentRegistry v2 on Mantle, Base, Arbitrum, Optimism and Polygon. Evidence-report and risk-score reads are listed on those five networks as well. The package says a tool returns an error naming the network and address when a required contract has no code on the selected network. Audit logging is Base-only without further configuration: use of another network requires an AuditVault v2 deployment selected through AUDIT_VAULT_<NETWORK>.
Installation uses npx -y @agentauditai/mcp-server, which starts a stdio server named agentaudit-mcp. The compiled JavaScript package requires Node.js 18 or newer and is MIT licensed. Write operations need a PRIVATE_KEY, whereas read operations do not. On Base mainnet and Base Sepolia, the write tools append a Base Builder Code suffix by default; the package says this changes a transaction hash but not the contracts' events, state, evidence, action references, or Merkle root.
The central operational warning is that commitBatch in AuditVault v2 has no access control. AgentAudit says anyone can commit a batch under any agent address, which can inflate counts and means the apparent agent address is not proof of the operator that submitted the batch. Both log reads and proof verification return the submitter. verify_proof also accepts an expected_submitter value, allowing a caller to reject a result unless it comes from an address it has authorized.
What the archive adds
New Runtime's earlier coverage includes Ghidra-mcp, which packages reverse-engineering capabilities behind an MCP server (8 October 2026), and Agno's HTTP MCP tool runner (30 October 2026). Those releases focused on integrations and access surfaces. AgentAudit adds an audit-recording use case, making this a new event in a known MCP tooling thread.
Trend signal
This supports the pattern that agent protocols become the interoperability layer. AgentAudit uses MCP as a shared surface for audit and evidence functions across compatible clients rather than requiring a separate client integration. The release shows an available integration path, not evidence of broad adoption, interoperability testing across clients, or a durable standard for agent identity.
Why it matters
For teams investigating agent behavior, a conventional application log can be changed by the system that produced it. Hashing entries and anchoring a Merkle root on-chain creates a way to test whether a retained entry corresponds to a committed batch. The MCP interface means a team can expose those operations to compatible clients without building a distinct audit integration for every agent harness.
The value depends on how the trust boundary is implemented. An on-chain commitment can help detect a mismatch between retained material and the committed tree, but it does not establish that the underlying action was correct, complete, or authorized. Nor does it decide which events a team ought to record. Teams will still need policies for payload selection, retention, access to private keys, evidence-bundle storage, and the human review process that follows an incident.
The submitter caveat is especially important. Since any party can commit under an arbitrary agent address, the agent address alone is not identity. A production verifier must compare the returned submitter against an address authorized for that agent, retain the returned evidence bundle, and decide what information is safe to hash before logging. The tooling can contribute to an evidence trail; it cannot make a legal determination or establish that the agent's actions were compliant.
Limits and uncertainty
AgentAudit's npm page does not establish an independent security review, operational reliability, production adoption, or the cost and latency of writing batches to Base. It also does not authenticate the submitter at the vault level; verification depends on an authorization rule maintained outside the contract. The statement that raw content stays in-process does not remove the need to protect local payloads, private keys, evidence bundles, and RPC configuration.
The package warns that it provides evidence rather than certification, and no legal finding of EU AI Act compliance follows from using it. The effectiveness of a deployment will also depend on whether the team retains complete bundles, controls its signer addresses, and verifies expected submitters consistently. Those operating practices are not enforced by the Base vault's access control.
Skill to build now
Create a minimal verification policy before connecting an audit MCP server to a production agent. Define which action types merit a commitment, designate the permitted submitter address for each agent, and store the returned evidence bundle outside the running process. Then test a rejected verification by supplying a mismatched expected_submitter; this turns the documented caveat into a check your team can operate rather than a warning left in configuration notes.
Reader takeaway
AgentAudit 3.0.0 makes MCP-accessible, Merkle-based action records available, with Base as the audit-log network and five networks for incident records and evidence reads. Treat it as an evidence mechanism, not a compliance shortcut: retain the returned bundle, protect the signing path, and verify each submitter against an independently authorized identity before trusting a record.