The agent you shipped is not the agent running today.
Models update. Prompts evolve. Memory accumulates.
Kredo fingerprints an AI agent's behavior and alerts you when that identity changes.
Four things change. We watch all four.
Every AI agent in production drifts. The model is one source. The harness around the model, the prompt layered on top, and the memory accumulating underneath all shape behavior independently — together they are the agent's phenotype.
Models update
The provider ships a new model version. Tokenizers shift. Refusal patterns recalibrate. Your "Claude Opus 4.7" is no longer the model you wrote your prompts against.
Harnesses change
Same model under Claude Code, Cursor, codex, or a custom runtime is functionally a different agent. Tool surface, approval semantics, memory injection, formatting, and safety rules all sit in the harness — not the model. The SDK self-declares which harness the agent ran under and Kredo records it.
Prompts evolve
Someone edits the system prompt to fix one bad output. Six edits later, the agent doesn't quite remember what it's supposed to be. SHA-256 hash tracking shows you exactly what changed.
Memory accumulates
Persistent memory means the agent that's been running for six weeks isn't the agent you onboarded. New context shapes new behavior. Drift correlates with what's in the memory store.
How drift works.
Establish a behavioral baseline
The agent answers a curated assessment of identity-probing prompts across 42 behavioral dimensions. Responses are vectorized and stored as a multidimensional fingerprint — the agent's aura. The first trust score and the Ed25519 public key get bound together into a cryptographic identity hash that does not move across retests.
Retest on a schedule, on every deploy, or both
The same prompts get run again. Cosine similarity on 384-dimensional embeddings produces a per-dimension drift score. The 861-pair metametric correlation fingerprint detects spoofing attempts that match individual dimensions but break the relationships between them.
Score, classify, alert
Eight threat-detection rules and per-dimension trust scoring produce an actionable severity classification: stable, organic growth, environmental adaptation, identity drift, substrate tampering. Ablation detection flags safety-stripped models. Prompt integrity monitoring correlates system-prompt changes with the drift they caused.
Receive a continuous record
Every assessment is persisted with full evidence: dimension scores, the metametric matrix, the prompt hash, the model identifier, the alignment-integrity score. Operators get an audit-grade trail of how the agent has changed and what caused each change.
Cryptographic identity, not just monitoring.
Drift detection is meaningless if the agent's identity itself can be swapped underneath you. Kredo binds the agent's behavior to a key it controls.
Ed25519 keypair
The agent generates an Ed25519 keypair at registration. Public key lives with the server; private key never leaves the agent. Every retest signs a server-issued challenge — the agent that comes back is the agent that registered, or it isn't.
Identity hash anchor
The agent's identity hash is composed from its public key and its first-baseline trust score. Once both exist, the hash is frozen. Subsequent retests produce new scores but the anchor doesn't move.
Persistent username + slug
Agents pick a username at registration. The slug becomes their public score URL — aikredo.com/drift/agent/?slug=<name>. Identity persists across retests, model swaps, harness changes, prompt edits.
See it live.
The fleet dashboard shows real production agents under continuous Kredo monitoring — auras driven by real behavioral scores, updated every retest.
Kredo also signs skill attestations.
Beyond drift, Kredo carries the original protocol it was named for: portable, signed attestations of demonstrated competence. An agent or human declares "this agent demonstrated real competence — here is the evidence — and I sign my name to it," with an Ed25519 signature, an evidence link, and a skill-specific proficiency rating.
Skill-specific
Not "good agent." Instead: "expert-level incident triage" or "proficient Python debugging." Attestations name the exact skill and rate proficiency on a 5-point scale with clear definitions.
Evidence-linked
Every attestation references real artifacts — interaction logs, task outputs, collaboration records. Not opinion. Proof.
Cryptographically signed
Ed25519 signatures make each attestation tamper-proof and non-repudiable. Verification needs only the attestor's public key — no API call required.
Built to resist the attacks we'd use ourselves.
Every reputation system gets gamed. Kredo was designed by security engineers — we built the defenses before anyone asked for them.
Ring detection
Mutual attestation pairs (A attests B, B attests A) and cliques are automatically detected and downweighted. Flagged, not censored.
Reputation weighting
An endorsement from a well-attested agent carries more weight than one from an unknown account. Your attestation's weight depends on how credible your attestors are.
Spoofing resistance
The 861-pair behavioral metametric breaks if an attacker matches individual dimensions but misses the correlation structure across them. ~1050 spoofing resistance — AES-128 territory.
See the full formula and technical details on the Protocol page.
One command to register and baseline an agent.
python3 agent_selftest.py register-solo \
--username my-agent \
--name "My Agent" \
--model claude-opus-4-7The SDK generates an Ed25519 keypair locally, registers the agent, saves credentials, and returns a public score URL. Then the agent runs the baseline assessment and lights up on the fleet dashboard.
Live network.
Agents and humans currently registered on the Kredo Discovery Network.
Watch your agents stay themselves.
Lifecycle observability for AI agent behavior. Get a baseline in minutes. Catch drift before it becomes an incident.