Correctover is the evidence layer that sits beside an agent runtime, MCP gateway, or LLM proxy. It captures each tool-boundary decision, signs a canonical receipt, keeps the audit trail queryable, and lets anyone verify the record offline — without trusting our console, our database, or our uptime.
SDK hook, gateway callback, or sidecar posts the decision event: tool name, verdict, correlation id, payload. Your stack stays where it is.
Fields are canonicalized so the same decision always hashes to the same bytes. Ambiguity here is what makes logs unusable as evidence.
Ed25519 over the canonical form. The signature binds verdict, tool, correlation, and payload hash to one artifact.
Third parties check the receipt offline against the public key. Tamper or replay shows up as a failed check, not a disputed screenshot.
Signed decision receipts with stable identifiers, quota accounting, and stored payloads. Receipts are written once and never silently rewritten.
A public verification path. Auditors do not need an account with us to check a receipt you hand them.
Fail-closed posture on the tool boundary when you opt in: if the evidence path is down, the call does not silently succeed unrecorded.
Workspace view of volume, quota, plan state, and receipt history, backed by an API your tooling can call directly.
Read current usage and limit from the same endpoint that writes receipts, so your own dashboards do not drift from billing.
Receipts and usage exported for SIEM or GRC evidence packs on Team and Business tiers.
| Method | Path | Purpose |
|---|---|---|
| POST | /api/v1/receipts | Write a receipt. Bearer cov_ key. Returns id, status, used, quota. |
| GET | /api/v1/receipts | Read workspace usage: plan, used, quota, status. |
| GET | /api/v1/account | Read account state: plan, quota, used, remaining, status. Never returns the API key. |
| GET | /api/v1/account/claim?session_id=… | Reveal the one-time API key for a provisioned session. Shown once, then gone. |
| POST | /api/v1/checkout/session | Create a subscription checkout session for a plan and email. |
| POST | /api/v1/stripe/webhook | Payment provider callback that activates the workspace and sets quota. |
| POST | /api/v1/audit-request | Request a scoped audit run against a target. |
All endpoints return JSON and send permissive CORS headers, so a browser console or a server job can call them the same way. Errors use stable machine codes such as unauthorized, quota_exceeded, unknown_plan.
curl -X POST https://correctover.com/api/v1/receipts \
-H "authorization: Bearer cov_xxx" \
-H "content-type: application/json" \
-d '{"verdict":"DENY","tool":"shell.exec","correlation":"run-42"}'
# 201
# {"id":"…","status":"stored","used":1,"quota":50000}Over quota the same endpoint returns 402 quota_exceeded. Existing receipts stay readable and verifiable; nothing is deleted to make room.
| Typical MCP gateway / AI control plane | Correctover | |
|---|---|---|
| Primary job | Auth, policy, route, observe | Decision evidence that survives outside the console |
| Audit artifact | Logs inside the product | Logs plus offline-verifiable signed receipts |
| Replace your gateway? | Often yes | No — sit after or beside it |
| Verification trust | Trust the vendor dashboard | Verify against a public key, no login |
| Commercial | Platform subscription | Subscription on evidence volume and seats |
We do not sit in your token path or meter model spend. Your gateway keeps that job.
We do not issue compliance certificates. We produce evidence your auditor can check.
The standard and the client side are open; the verification path is public. You are not renting access to your own records.
| Mode | Where it runs | Keys | Tier |
|---|---|---|---|
| Hosted | Our control plane | Our signing key per workspace | Starter, Team |
| Private | Your cloud account | Your signing key | Business |
| Embedded / OEM | Inside your product | Your key, your brand | Business |
Verification is identical in all three modes: the receipt carries the key reference, so a verifier resolves the right public key without a call to us.
Bring one real agent flow and we will show the receipt for it.