# LLM Notary

> Capture provider calls locally, retain encrypted bundles, and finalize selected calls into independently verifiable OpenTelemetry trace packages.

## Documentation

- [Overview](https://notary.exalto.ai/docs): Capture, deferred finalization, portable packages, and shared verified sessions.
- [Trust and guarantees](https://notary.exalto.ai/docs/how-it-works): The exact provenance claim, participants, authenticated versus observed data, and limits.
- [Install options](https://notary.exalto.ai/docs/getting-started): Choose the guided Apple silicon macOS app or install the CLI and local service for SDKs, coding agents, servers, and automation.
- [Pricing](https://notary.exalto.ai/#/pricing): Monthly capture, notarization, and trace-storage plans, plus additional notarization credits.
- [Plans and usage](https://notary.exalto.ai/docs/hosted-credits): Subscription allowances, Stripe billing, additional notarization, trace storage, and public allowances.
- [Trace packages](https://notary.exalto.ai/docs/trace-packages): Finalization, package layout, disclosure, and offline verification.
- [Verify online](https://notary.exalto.ai/#/verify): Explicitly upload one finalized package for retention-free hosted verification.
- [Share](https://notary.exalto.ai/docs/share): Preview and deliberately share an already-finalized trace package as Unlisted or Listed, then manage unpublish, password, and expiry access from the hosted account.

## Core trust boundary

The local proxy handles plaintext and provider credentials. The remote notary participates in the authenticated provider TLS connection without receiving API-key values, prompts, or responses. A pending encrypted bundle is private retry state, not public proof. A finalized `.llmtrace` package is independently verifiable with the trusted notary public key. It hides every HTTP header value except the exact structural value `Transfer-Encoding: chunked`, but its authenticated request and response bodies remain disclosed.

Public hosted allowances are scoped by a keyed, rotating subject derived from one IPv4 address or one IPv6 /64 prefix. This is a coarse abuse control, not a claim about a person's identity and not a privacy guarantee. Users behind the same NAT, gateway, or VPN may share an allowance.

Free accounts get 50 MB each of hosted capture and notarization per month and can store up to 1 GB of uploaded trace packages. The $9.99/month plan raises both monthly allowances to 1 GB and trace storage to 10 GB. The $49.99/month plan raises both allowances to 10 GB and has no fixed trace-storage ceiling, subject to fair-use and abuse controls. Every plan can buy non-expiring additional notarization for $10 USD per GB. Verification, downloads, Library browsing, and self-hosting do not use these allowances.

On first use, the daemon creates a user-editable `config.toml` at the standard platform configuration location. It enables routes for the OpenAI API, ChatGPT-authenticated Codex, Anthropic, DeepSeek, and OpenRouter by default; keeps encrypted bundles and finalized packages under the platform data directory; and creates a local SQLite catalog. The catalog indexes short, plain-text prompt and output previews for search, along with provider, model, status, size, duration, and artifact metadata. It does not store header values, cookies, or credentials.

Subscription-backed authentication is supported and live-tested with Codex CLI using its saved ChatGPT login through the fixed `/codex` route and with Claude Code using its saved claude.ai login through `/anthropic`. LLM Notary does not collect browser cookies, read either tool's auth cache, or perform login and refresh flows. These routes prove the authenticated provider host and disclosed bodies, not an account owner, subscription tier, or billing. The LLM Notary macOS app can supervise the local proxy, but it does not make vendor application traffic use it automatically. Native Claude Desktop is not configurable for this route. Codex desktop is not yet an end-to-end-tested or supported client surface. Browser, Slack, remote, and cloud agent sessions do not run through the local proxy.

## Local service and API

```sh
curl -fsSL https://notary.exalto.ai/install.sh | sh
llm-notary skill install --target all
llm-notaryd
```

To build from source instead:

```sh
git clone https://github.com/exalto-ai/llm-notary.git
cd llm-notary
cargo install --locked --path crates/llm-notary-client
llm-notaryd

curl http://127.0.0.1:8788/healthz
curl http://127.0.0.1:8788/openapi.json
llm-notary --json captures list --metadata-only --query pricing
```

LLM Notary is pre-release. The guided app supports Apple silicon Macs running macOS 12 or later; production app downloads are signed, notarized, and published with the CLI archives. The website's latest channel tracks the latest successfully published main build. The CLI installer verifies the downloaded archive against a SHA-256 value from the same publisher, which detects corruption but is not an independent release signature. `llm-notary skill install --target codex`, `--target claude`, or `--target all` installs the bundled portable agent skill without contacting the daemon; `--skills-dir` supports another Agent Skills compatible client. The skill teaches approval, verification, disclosure, and secret-handling boundaries while using the live local OpenAPI contract. Claude Code installs under `$CLAUDE_CONFIG_DIR/skills` when that environment variable is nonempty and under `~/.claude/skills` otherwise. It detects changes inside an existing personal skills directory; restart it if that directory did not exist when the current session started. Open `http://127.0.0.1:8788` for the local dashboard. Use `llm-notary status`, `llm-notary captures list`, or another CLI command to operate the daemon through its versioned REST API; add `--json` for automation. Raw capture-list JSON includes stored prompt and output previews, so use `--metadata-only` before sending structured capture results to an agent transcript. The loopback admin API is open to local processes by default; an installation can require HTTP Basic credentials by setting `admin.auth` to a username and Argon2id password hash. Use `llm-notaryd --config /path/to/config.toml` to start the daemon with a non-standard local configuration, and pass the same `--config` option to CLI commands. For a self-hosted notary, set `notary.endpoint` and `notary.public_key` together in that file. Hosted services discover the notary endpoint and key from a versioned directory served over authenticated HTTPS; the directory JSON is not separately signed.

## Package layout

```text
<capture-id>.llmtrace (ZIP)
├── archive-manifest.json
├── evidence.tlsn
├── manifest.json
├── request.disclosed.http
├── response.disclosed.http
└── trace.otlp.json
```