A receipt proves that a specific SHA-256 hash (or a structured action manifest) was submitted to mpps.io at a specific time, was signed by AWS KMS HSM key material that never leaves the HSM, and has been stored unmodified since. If you later present a file that hashes to the same value, the receipt proves that exact content existed no later than the receipt's timestamp.
It does not prove the content is true, high quality, legal, or who authored it. Precise claims, deliberately narrow.
Yes. The free tier allows 10 structured receipts per hour, 10 raw hash receipts per hour, and 10 certified metadata receipts per day — no registration, no API key. Verification is unlimited. After the free daily certify quota, an optional $0.01 payment path exists.
OpenTimestamps anchors hashes into Bitcoin: decentralized, but confirmation takes hours, there is no structured metadata, and no human-readable certificate. mpps.io returns an HSM-signed receipt in one HTTP round trip, supports structured action manifests, stores receipts immutably for 10 years, and verifies offline. The trade-off is the trust model: OpenTimestamps trusts Bitcoin; mpps.io is an independent witness you trust like a notary or a certificate authority. See the full comparison of timestamping and attestation options.
No. All endpoints work without registration, API keys, or credentials. One HTTP POST with a hash is enough. This is deliberate: agents and CI pipelines can adopt it with a single curl command.
mpps.io only ever receives hashes and small labels you choose to send — never raw file content. A SHA-256 hash does not reveal the content it was computed from. Stored receipts contain the hash, timestamp, signature, and any metadata you explicitly included. Do not put secrets or personal data in labels or context fields.
Receipts remain verifiable offline. Each receipt contains the signed payload and signature, and the RSA public key is published at api.mpps.io/v1/public-key and in the open-source repository. Anyone can verify the RSA-PSS SHA-256 signature with standard tooling without contacting mpps.io. Stored copies also sit in S3 Object Lock Compliance Mode with 10-year retention, which even the operator cannot delete early.
Article 12 of the EU AI Act requires high-risk AI systems to automatically record events over their lifetime, and regulators expect those logs to be tamper-evident. mpps.io does not make a system compliant by itself — but anchoring periodic hashes of your log stream to an independent external witness is one recognized way to make logs tamper-evident: any later modification breaks the hash chain against receipts you do not control. Full details: EU AI Act tamper-evident logging guide.
Yes — that is the primary design goal. Any agent that can run curl can create a receipt. Installable skills exist for OpenClaw (npx clawhub install mpps-attestation) and skills.sh (npx skills add gdlg-ai/mpps.io), and the API is described for machines at api.mpps.io/llms.txt.
/v1/receipts creates a structured agent action receipt: action name, artifact hashes, input hashes, workflow context, and an optional parent receipt, canonicalized and signed as one manifest. /v1/notarize is the minimal form: one hash in, one signed receipt out. /v1/certify adds human-readable metadata and a printable certificate page. All three are HSM-signed and stored identically.
mpps.io is an independent open-source project (MIT license) built by GlideLogic Corp. (OTCQB: GDLG). The API implementation, SDK, and offline verifier are public at github.com/gdlg-ai/mpps.io.