Cedulon

Missing evidence is itself evidence.

Agents can already pay on open rails such as x402 and AP2. Cedulon sits above those rails as an audit layer: a signed spend receipt, a chained epoch checkpoint, and a reconciliation of the rail extract. If a spend left no receipt, the gap is the finding. Bookkeeping moved from single-entry records to Pacioli's double-entry; Cedulon is the later step where an external rail extract is machine-checkable.

How it works

Cedulon flow from manifest to reconciliation audit Trade Manifest signed offer before payment Policy Decision Point default deny, fail-closed Payment rail x402 or other settlement Signed Spend Receipt COSE_Sign1, Ed25519 Epoch Checkpoint totals and previous hash Reconciliation Audit rail extract versus receipts

The gap we close

Anyone can verify a receipt

A signed spend record checks as valid or tampered. That is the easy half.

Nobody sees a missing receipt

A spend that never issued a receipt leaves no object to verify. The books still look clean.

Cedulon turns the gap into evidence

The companion audit compares the rail extract to the receipt chain. A bypass in this repository prints audit: 1 settlement without receipt → FAIL

Gated spend (repository API)

import { PolicyEngine } from "@cedulon/core";
import { generateReceiptKeys } from "@cedulon/receipts";
import { gatedSettle } from "@cedulon/x402-adapter";

const engine = new PolicyEngine({
  maxAmount: 10n, maxCumulative: 30n, maxPayments: 3, windowMs: 3600000,
});
const keys = generateReceiptKeys();
const result = gatedSettle(engine, {
  req: { amount: 1n, currency: "USD", payee: "q", nonce: "n1", nowMs, tool: "spend" },
  payer: "p", paymentHeader: "mock",
}, { receiptPrivatePem: keys.privateKeyPem, receiptPublicPem: keys.publicKeyPem }, nowMs);

Use it as an MCP server

The same gated spend and extract audit are also five MCP tools on stdio, published on npm as @cedulon/mcp-server. Point Claude Desktop, Claude Code, or Cursor at it; there is nothing to clone or build. Step-by-step: Cedulon in 5 minutes. 

{
  "mcpServers": {
    "cedulon": {
      "command": "npx",
      "args": ["-y", "@cedulon/mcp-server"]
    }
  }
}

Measured in this repository