Loading…
Open-source · Apache-2.0 · model-agnostic
Know what your AI agent did — and stop the risky moves before they happen.
We don't tell you what happened. We show you what the evidence proves.
Every action routed through Noa gets a signed, tamper-evident receipt — proof you verify yourself, offline, no Noa account needed. Install the MCP proxy or SDK core from npm today; pausing risky actions for your sign-off is live in the MCP proxy. Model-agnostic — works today with any MCP host or Node app.
safe → auto-allow risky → your approval forbidden → blocked
receipt issued · agent action sealed
The approval moment Noa enables — live in the MCP proxy today. The one-tap phone app is in App Store review.
Submitted to the App Store and Google Play on 2026-08-11 — pending store review
In plain words
The AI assistants you already use are starting to do things, not just answer.
Noa is the safety brake that stops your AI from accidentally sending money, deleting the wrong files, or doing something important without a check.
Think of it like the second approval before a big bank transfer — but for AI agents.
The short version
Four questions, four plain answers.
What is it?
A safety layer between your AI assistant and the real world. Before it does something that actually matters, Noa checks it first.
How does it work?
Safe actions just go through. Risky ones pause for your approval. Forbidden ones are blocked. Every action routed through Noa leaves a tamper-evident receipt you can verify yourself.
Why do you need it?
AI makes mistakes, and AI assistants are starting to do real things — pay, email, delete, change live systems. Once a wrong action runs, it's done. Noa stops it before it runs.
What you get
The confidence to finally let AI do real work. A verifiable, tamper-evident receipt for every action. You decide what needs your sign-off. Works with your agents today — MCP proxy or Node SDK. Open-source — read and verify everything.
The problem
AI agents are starting to do things — pay, refund, email, delete, deploy. And AI makes mistakes.
Once a wrong action runs, it's done. That's why teams keep agents read-only — too scared to give them real power.
After-the-fact
Logs tell you what happened.
By the time it's in the log, the payment is sent and the rows are deleted. A rear-view mirror can't stop the crash.
Before it runs
Noa decides what should — before it runs.
The risky action waits for a check or an approval. The hallucination never reaches the irreversible step.
How it works
Three steps, from agent intent to a receipt you can verify.
- 01
Agent proposes an action
Your agent calls a tool — refund a payment, send an email, drop a table. Once integrated, Noa intercepts the request before it executes.
agent → propose( payment.refund ) - 02
Noa gates it
Safe actions auto-allow in sub-millisecond. Risky ones require a human approval. Forbidden ones are blocked outright — by the policy you wrote.
auto-allow safeapprove riskyblock forbidden - 03
A tamper-evident receipt is issued
Every verdict is sealed into a hash-chained receipt — who, what, which rule, what happened. For reversible actions, an integration can attach a verified rollback path — and Noa receipts the rollback when it happens.
receipt rcpt_… · hash sha256:… · prevHash ↩
Every receipt links to the last one. Edit any past receipt and the chain breaks at the next hash.
The demo
A hallucinating agent tries to refund $1,000,000.
Noa doesn't just block — for a risky call it can pause for your sign-off, then execute and seal a receipt. Wrap one tool with the SDK core, live on npm today; the approval pause below is live in mcp-proxy 0.3.2 today.
agent.tslive on npm
Wrap any tool with noa-mcp-adapter-core's preCheck — model-agnostic — and Noa gates every call: auto-allow safe, block forbidden, before it executes. The approval-pause step in the timeline on the right is live in mcp-proxy 0.3.2 today.
SDK core (noa-mcp-adapter-core) and MCP proxy (noa-mcp-proxy) are live on npm today — the approval-pause in the timeline is live in mcp-proxy 0.3.2 today. Verify a receipt yourself, live today: npx noa-receipt verify (right).
noa · live
approved + executed + receipted
noa · forbidden action
blocked — never ran
verify it yourself
$ npx noa-receipt verify receipt.json --keyring keys.json
✓ tamper-evident · chain intact · 3/3 receipts valid
Also inspect the published package artifact: npm pack noa-receipt@0.8.0 → node dist/src/cli.js verify …
Offline. No Noa account. The verifier recomputes every hash and checks each prevHash link — if anyone edited a past receipt, it fails right at that sequence.
Or verify a chain right now, in your browserWhy open source
A trust layer you have to blindly trust isn't a trust layer.
Noa's policy rules and receipt format — the governance/receipt organ — are open-source (Apache-2.0). You read the rules. You verify the receipts. Offline. No Noa account required.
$npx noa-receipt verify receipt.json --keyring keys.json→ ✓ tamper-evident
The name
Why Copenhagen?
Copenhagen is what we call one rule, and the rule is a restriction: a verifier never states what happened. It states what the supplied evidence supports — and records what it does not claim. Whatever the code will not vouch for is written down, not left for you to assume.
You can watch the rule work. Verify a receipt chain without a keyring and the answer is not a pass: the status comes back UNVERIFIED, and the result names what went unchecked — the signatures were never authenticated, and with no checkpoint supplied, deleting the most recent receipts cannot be detected offline. A pass has to be earned; the gaps are printed either way.
$npx noa-receipt verify receipts.json→ UNVERIFIED · signatures not authenticated (no keyring)
The name nods to the Copenhagen interpretation in physics, and to the line that travels with it: that physics is not about what nature is, but about what we can say about nature. That sentence is attributed to Niels Bohr, via Aage Petersen, 1963 — it does not appear in Bohr’s own writing, and we say so rather than sign it with his name. A discipline about stating only what you can support has to start with its own sources.
For the skeptics
Overhead
A policy check on the safe path is an in-memory comparison — no network round-trip. Actions the gate auto-allows go straight through; only the ones your policy, or a two-person rule, holds for approval pause.
Fail-mode
Fail-closed by default (configurable). If Noa can’t decide, the risky action waits — it doesn’t slip through.
What receipts store
Raw parameters are never stored in a receipt — only their hashes — and the approver appears as an opaque id, not a name. No raw data, customer info, or secrets.
FAQ
Straight answers, including the uncomfortable ones.
That is up to your policy, not to Noa. A policy check on the safe path is an in-memory comparison with no network round-trip, so the check itself does not hold up an action the gate auto-allows. The calls that wait are the ones held for approval — the ones your policy marks risky, plus any your two-person rules require. The hosted console does more around that check (it reads your org, policy and rules), so it is not a promise about end-to-end latency; it is a statement about what the safe-path check does and does not do.
For developers
Four ways in. Pick the one that fits your stack.
The verify CLI, the MCP proxy, and the tool-gating SDK core are all live on npm today. Runtime human-approval-in-the-loop — pausing a risky action for your sign-off — is live on npm today too (mcp-proxy 0.3.2 --approval-rules).
MCP proxyzero-code · live on npm
Drop the proxy in front of any MCP host — every tool call is governed today: auto-allow safe, block forbidden, no rewrites.
$ npx noa-mcp-proxy -- node your-server.mjs
→ every tools/call gated: ALLOW → forwarded + receipted
DENY → blocked + receiptedpreCheckSession()one function call · live on npm
Gate a single tool call in CrewAI, LangChain, or your own executor — one function call, any framework.
$ npm install noa-mcp-adapter-core
const { decision, receipt } = preCheckSession(toolCall, opts);
if (decision === 'ALLOW') await run(toolCall);
// receipt is signed + hash-chained either wayNoa Receiptopen spec
A small, hash-chained JSON format storing parameter hashes, never raw values. JSON-Schema + conformance suite.
{
"spec": "noa.receipt/0.1",
"governance": { "verdict": "EXECUTED" },
"chain": { "seq": 42, "hash": "sha256:…" }
}npx noa-receipt verifyverify · live on npm
Recompute every hash, check each prevHash link. Offline, no service.
$ npx noa-receipt verify receipts.json --keyring keys.json
→ ✓ VALID · signatures + chain intact
(or) ✗ TAMPERED at seq=37Give your agents real power — safely.
Noa is open-source and live now — no waitlist, no signup. Install the packages, run them in your own environment, and verify every receipt yourself, offline. A run-it-for-you hosted gate service is on the roadmap.
$npm install noa-receipt
Submitted to the App Store and Google Play on 2026-08-11 — pending store review
No waitlist for the open-source core — it is usable today from npm or source. The hosted Enterprise Console is live in beta; self-serve signup is on its way, and access today is provisioned on request. A hosted relay and a run-it-for-you gate service are still on the roadmap.