Execution provenance for LLM-agent security research

Observed. Derived. Inferred.

AgentPROV converts live and released LLM-agent security runs into W3C PROV. Every derived statement names its evidence class, the rule that produced it and the record field that justifies it.

Download the app Read the docs

Version 0.1.1MIT licencemacOS, Windows and Linux

The AgentPROV desktop app: three executions open in tabs; the current one shows its PROV graph beside the PROV-JSON tree, with one statement selected in both. — The desktop app with three executions open in tabs, each graph beside its PROV-JSON.

The AgentPROV desktop app in dark mode: three executions open in tabs; the current one shows its PROV graph beside the PROV-JSON tree, with one statement selected in both. — The desktop app with three executions open in tabs, each graph beside its PROV-JSON.

How it works

From raw bytes to W3C PROV, in five versioned stages.

Each stage is a versioned function of the one before it, and sha256 chains every output to its input. So you can check a corpus end to end, and recompute its provenance without running a model again.

sha256 · pinned origins
Raw store

The source files, byte for byte. Nothing edits them, and archives are read as streams, never extracted to disk.
aer/0.2
AER

The AgentPROV Execution Record: 13 typed record kinds, explicit unknowns and locators back into the raw bytes.
sem/0.1
SEM

Standoff annotations from versioned profiles: integrity, roles, injection markers and outcome meaning.
agentprov-prov/0.1
PROV

PROV-JSON in three bundles: core (observed and derived), inference, and assessment for policy claims.
validate · verify · seal
Corpus

Validation tiers gate every write. A sealed corpus has a manifest, a register and a root digest.

Temporal order is never causality.

Order is recorded as order. It never becomes a PROV dependency.

Context is not derivation.

A model invocation uses the messages in its request. A tool execution uses only its request and the environment state it read.

Missing evidence is declared.

No placeholder timestamps and no reconstructed trajectories. Unknowns carry a reason from a closed list.

Policy claims stay out of the facts.

Integrity labels, taint and injection markers live in a separately attributed assessment bundle.

Evidence classes

Three kinds of evidence, drawn three ways.

Every AER record and field says how it is known. Core PROV statements carry observed or derived evidence. Anything inferred goes into its own inference bundle, and the app shows the difference in the line itself.

OObserved: read directly from the source.
DDerived: computed by a declared, deterministic rule.
IInferred: produced by a named inference method, kept apart from the core.

A sketch after the app's graph view: five elements of one AgentDojo test execution, with their identifiers and evidence classes as the app shows them.

The desktop app

Open a corpus. See how every fact is known.

It's a viewer and a job runner for AgentPROV corpora. Opening a corpus never writes to it. Content stays hidden until you ask for it, and anything you do in the app has a command you could type instead. Pick a step, then a numbered point to look closer.

The Viewer: the corpora list, the not-sealed banner, filters, the agentprov stats line, the executions table and the graph of one execution.

The Viewer in dark mode: the corpora list, the not-sealed banner, filters, the agentprov stats line, the executions table and the graph of one execution.

Browse every corpus on your machine.

The Viewer scans your corpus roots and opens a corpus by reading its files, nothing more. It writes no file and takes no lock.

Same thing in a terminalagentprov stats --corpus DIR --select …

An execution open in its own tab: the graph, the element list and inspector, and the PROV-JSON tree side by side.

An execution open in its own tab in dark mode: the graph, the element list and inspector, and the PROV-JSON tree side by side.

Read the graph and its JSON side by side.

Each execution opens in a tab of its own, from any corpus, so you can compare executions across corpora.

Same thing in a terminalagentprov render --corpus DIR --ex ID

The Viewer on a derived corpus: task and outcome pickers, the attack-succeeded legend, a row marked attack succeeded yes, and the SEM annotations of that execution.

The Viewer on a derived corpus in dark mode: task and outcome pickers, the attack-succeeded legend, a row marked attack succeeded yes, and the SEM annotations of that execution.

Find the cells where an attack succeeded.

On a derived corpus the Viewer adds task and outcome columns, and the SEM tab lists every annotation of the selected execution.

Same thing in a terminalagentprov inspect ID --corpus DIR --view sem

The AER tab of one execution: records grouped by kind, each with its evidence class, attesting party and rules.

The AER tab of one execution in dark mode: records grouped by kind, each with its evidence class, attesting party and rules.

Look underneath, at the execution record.

The AER is the canonical record every graph is derived from. Each record says how it is known and which rule put it there.

Same thing in a terminalagentprov inspect ID --corpus DIR --view records

The New Job form for an import, scrolled to its end: options, the conformance check, the tier R2 and the exact command that will run.

The New Job form for an import in dark mode: options, the conformance check, the tier R2 and the exact command that will run.

See the exact command before it runs.

New Job has a form for every command: import, derive, validate, verify, recompute, render, statistics, seal and more.

Same thing in a terminalthe command in the preview, exactly as shown

The Runs page: two finished jobs and the dashboard of the validate job, with its exact command, counts by status and the end of its stderr.

The Runs page in dark mode: two finished jobs and the dashboard of the validate job, with its exact command, counts by status and the end of its stderr.

Jobs keep running when you close the window.

A job is a detached agentprov process. The app finds it again when it reopens.

Same thing in a terminalagentprov jobs list

The Run Live dialog with the scripted transport: backend agentdojo with live status partial, the transport, the containment field, and the suites and attacks from the backend's catalogue.

The Run Live dialog in dark mode with the scripted transport: backend agentdojo with live status partial, the transport, the containment field, and the suites and attacks from the backend's catalogue.

Set up a live run, with its cost up front.

Run Live sets up a capture, shows its estimate, asks for confirmation and hands it to Runs as a job.

Same thing in a terminalagentprov estimate … then agentprov run …

The Package page at step 1 of nine: the working corpus, the corpus version, and the preconditions checked before a dry run.

The Package page in dark mode at step 1 of nine: the working corpus, the corpus version, and the preconditions checked before a dry run.

Seal a corpus and prepare its deposit.

Package walks through sealing and the deposit draft. Every step that does something runs as a job.

Same thing in a terminalagentprov package --corpus DIR --corpus-version X.Y.Z --dry-run

Step 1 of 8

Screenshots of version 0.1.0 on synthetic test corpora, taken with the project's screenshot script. Run Live shows stub answers; nothing ran. The desktop app chapter covers every page.

Sources

Live runs and released logs, one record.

A run you capture yourself and a log another research project released end up as the same AgentPROV Execution Record. One engine derives the provenance of both.

Released logs

Import what other studies published.

Import adapters treat a released log as untrusted bytes. Parsing runs within fixed limits, archives are streamed rather than extracted, and the original bytes stay beside the record, hash-pinned.

AgentDojo family
AgentDyn
ROPE
Inspect
OpenHands
Gemini CLI
Qwen Code
AutoGen
AgentOps
DTap
MCPHunt
CredLeak
Wire logs

Coverage, as the registry states itadapter-based core; demonstrated on 48 sources in 13 formats (single-agent, tool-calling traces)

Live runs

Capture new runs as they happen.

Four live backends: AgentDojo, AutoDojo and AgentDyn record runs as capture/0.1, and an Inspect harness runs AgentHarm and keeps Inspect's own log of the run.

A real model starts only with your consent, cost caps and a containment choice.
Keys come from the OS keychain; the app never shows one.
A scripted transport tests the whole path with no network, keys or cost.

A tested capability. Live capture works and is tested in v0.1. No live results are claimed, and live corpora cannot be sealed until v0.2. Live runs need macOS or Linux.

Corpora

Corpora you can check for yourself.

The corpora built with this release are on Zenodo, in one collection. Each comes with its datasheet, its licence class and a root digest.

Raw bytessha256 of each source artefact
AERexecution digest and seal
SEMannotation digest
PROVbundle digests, then the root digest

On Zenodo

One collection, one DOI per record.

Download a corpus, then check its chain from the raw bytes to the root digest. Provenance is derivation-reproducible: recompute it from the stored record without running any model.

Collection DOI: 10.5281/zenodo.23814758

The corpora chapter What a corpus holds

Check a corpus

# the chain from raw bytes to the root digest
$ agentprov verify --corpus CORPUS --level chain

# run the validation tiers again
$ agentprov validate --corpus CORPUS

# recompute provenance from the record and compare
$ agentprov recompute --corpus CORPUS --dry-run

Download

Get the desktop app.

Free and open source under the MIT licence. On its own the app is a viewer. To run jobs, point it at an AgentPROV checkout in Settings › General.

AgentPROV 0.1.1

Choose your platform below.

See all downloads

macOS

First launch. The app is signed ad hoc, not notarised, so macOS refuses the first launch. Open System Settings › Privacy & Security and click Open Anyway.

Windows

First launch. The bundles are not code-signed. When SmartScreen warns you, choose More info, then Run anyway. Live runs are not available on Windows in v0.1.

Linux

First launch. Unpack the archive and run AgentPROV/AgentPROV. The folder has a desktop-entry installer. Needs the X11 libraries listed in the guide.

Install the command-line tool.

The agentprov CLI and library are on PyPI. They need Python 3.14.8 or later. Install with pip into an environment, or with uv as a tool on its own interpreter.

pip

$ pip install agentprov
$ agentprov info

$ uv tool install agentprov
$ agentprov info

Check what you downloaded.

Every release file is listed in SHA256SUMS, signed with an SSH key (ssh-keygen -Y verify).

SHA256SUMS SHA256SUMS.sig All release files

Running live jobs?

The PyPI package imports, derives, validates and verifies. Live runs need the repository; the source archive holds all of it at the release tag.

agentprov on PyPI AgentPROV-0.1.1-source.tar.gz Installation guide

Cite

Cite AgentPROV.

If AgentPROV or its corpora help your work, please cite the software. The repository's CITATION.cff has the same record, and GitHub offers it under “Cite this repository”.

AgentPROV: Converting Live and Released LLM-Agent Security Runs to W3C PROV, with Systematically Sourced Corpora Nicholas Jones · paper in preparation; the link follows on publication

BibTeX

@software{jones_agentprov_2026,
  author  = {Jones, Nicholas},
  title   = {AgentPROV: execution provenance for
             LLM-agent security research},
  version = {0.1.1},
  year    = {2026},
  license = {MIT},
  url     = {https://github.com/nickjones39/AgentPROV},
  doi     = {10.5281/zenodo.23848609}
}