Membrane binds an agent's intent, policy, payment, response, and memory into a single tamper-evident proof — anchored on-chain, verifiable offline, and open across every rail: x402, AP2, ACP, MCP, A2A.
Payments, identity, and memory for AI agents are all shipping at once. The connective tissue that proves an action actually happened — under whose authority, against what budget, producing what result — is the layer no one owns yet.
Membrane isn't a chain, a wallet, or a memory store — it's the attestation that binds them. Each consequential agent action produces one signed, portable bundle, and any party can verify it offline, with no trust in Membrane required.
Mem0, Zep and Letta give your agent a memory.
Membrane gives that memory a receipt.
Membrane sits in the path of the agent's existing tools. It doesn't replace your stack — it observes, captures, commits, and anchors.
The agent signs an intent mandate; a spending policy is active. The authorization is captured before anything moves.
Tool-call envelope, payment receipt, response hash, and the memory entry written — each hashed with its provenance.
The layers are bound into one attestation and folded into a Merkle root with other actions in the batch.
The root is anchored on-chain. Anyone will run an offline verifier and get a clean yes / no — no trust in Membrane required.
A canonical registry lives on Avalanche. A byte-identical anchor contract deploys to the same address on every EVM chain. Proofs anchor where the agent actually works — and verification never depends on a bridge.
The canonical index is on Avalanche C-Chain. Every spoke anchor back-references it — one place to look up any Membrane proof, on any chain.
Target surface: an SDK in TypeScript and Python, a local verifier, and an MCP server — so any MCP-aware agent can get Membrane attestation by adding one server. Receipt-format pluralist by design: x402, AP2, ACP, Stripe and Circle receipts all flow into the same bundle.
Target: wrap a tool call, emit an attestation. One import, sane defaults.
Target: chain-config-driven. Reads the anchor on its home chain, checks the Merkle proof, done.
Planned tools: attest_call, verify_bundle, query_memory_proof — for every MCP-aware agent.
x402, AP2 mandates, ACP SPTs, Stripe & Circle webhooks — equivalent inputs into one attestation.
When an agent touches money, data, or a consequential decision, "we logged it" isn't enough. Membrane turns every agent action into a signed, tamper-evident record — readable by an auditor, verifiable by anyone.
Target demo: an agent, USDC, and an x402 endpoint on Avalanche Fuji — ending in one composite proof a user, or a compliance officer, can verify offline. Not a public runnable artifact yet.
"Buy a 30-day API key from Provider X if it's under $20." Signed as an intent mandate.
The agent hits the provider's x402 endpoint and receives a payment-required challenge.
The agent signs and broadcasts a USDC payment — within the active spending policy.
An x402 receipt and the API key come back. The response is content-hashed.
"Purchased API key for Provider X, expires <date>" — written with full provenance.
Intent, policy, receipt, response hash, memory entry — bound and anchored to Fuji.
Membrane is building an open attestation layer for AI agents — Avalanche by home. Read the architecture, or talk to us about a pilot.