Membrane binds an agent's intent, policy, payment, response, and memory into a single tamper-evident proof — anchored on-chain, verifiable offline, and open across every rail: x402, AP2, ACP, MCP, A2A.
Payments, identity, and memory for AI agents are all shipping at once. The connective tissue that proves an action actually happened — under whose authority, against what budget, producing what result — is the layer no one owns yet.
Membrane isn't a chain, a wallet, or a memory store — it's the attestation that binds them. Each consequential agent action produces one signed, portable bundle, and any party can verify it offline, with no trust in Membrane required.
Mem0, Zep and Letta give your agent a memory.
Membrane gives that memory a receipt.
Membrane sits in the path of the agent's existing tools. It doesn't replace your stack — it observes, captures, commits, and anchors.
The agent signs an intent mandate; a spending policy is active. The authorization is captured before anything moves.
Tool-call envelope, payment receipt, response hash, and the memory entry written — each hashed with its provenance.
The layers are bound into one attestation and folded into a Merkle root with other actions in the batch.
The root is anchored on-chain. Anyone runs kwi-verify offline and gets a clean yes / no.
A canonical registry lives on Avalanche. A byte-identical anchor contract deploys to the same address on every EVM chain. Proofs anchor where the agent actually works — and verification never depends on a bridge.
The canonical index is on Avalanche C-Chain. Every spoke anchor back-references it — one place to look up any Membrane proof, on any chain.
An SDK in TypeScript and Python, a local verifier, and an MCP server — so any MCP-aware agent gets Membrane attestation by adding one server. Receipt-format pluralist: x402, AP2, ACP, Stripe and Circle receipts all flow into the same bundle.
Wrap a tool call, emit an attestation. One import, sane defaults.
Chain-config-driven. Reads the anchor on its own home chain, checks the Merkle proof, done.
Exposes attest_call, verify_bundle, query_memory_proof — to every MCP-aware agent.
x402, AP2 mandates, ACP SPTs, Stripe & Circle webhooks — equivalent inputs into one attestation.
When an agent touches money, data, or a consequential decision, "we logged it" isn't enough. Membrane turns every agent action into a signed, tamper-evident record — readable by an auditor, verifiable by anyone.
The wedge demo: a real agent, real USDC, a real x402 endpoint on Avalanche Fuji — and one composite proof at the end that a user, or a compliance officer, can verify.
"Buy a 30-day API key from Provider X if it's under $20." Signed as an intent mandate.
The agent hits the provider's x402 endpoint and receives a payment-required challenge.
The agent signs and broadcasts a USDC payment — within the active spending policy.
An x402 receipt and the API key come back. The response is content-hashed.
"Purchased API key for Provider X, expires <date>" — written with full provenance.
Intent, policy, receipt, response hash, memory entry — bound and anchored to Fuji.
Membrane is open source and being built in public. Integrate the SDK, run the verifier, or talk to us about a pilot before the August deadline.