# ArkForge — Full Content Index for LLMs

This file contains structured content from arkforge.tech for LLM consumption and citation.

---

## Product: ArkForge Trust Layer

### What it does
ArkForge Trust Layer is a certifying proxy for AI agent API calls. It intercepts an agent's outbound API call, executes it on behalf of the agent, and returns both the API response and a cryptographic proof bundle. The proof certifies: which API was called, with what payload, at what timestamp, and what response was returned.

### How it works (technical)
1. Agent sends API call to `trust.arkforge.tech/v1/proxy` instead of the target API
2. Trust Layer forwards the call to the real target API
3. Trust Layer computes SHA-256 fingerprints of the request and the response and binds them, with the time and the parties, into a chain hash (Merkle root of per-field commitments, spec 3.1)
4. The proof is attested in three ways:
   - ArkForge Ed25519 signature over the chain hash (shows ArkForge issued it; not independent of ArkForge)
   - RFC 3161 timestamp on the batch root, from FreeTSA with DigiCert or Sectigo as fallbacks (independent of ArkForge; not eIDAS-qualified)
   - Sigstore Rekor append-only transparency log entry for the batch root (independent of ArkForge)
   Batches close at 100 proofs or 10 minutes; before that, only the signature vouches for the proof.
5. Proof is stored (1-year retention) and assigned a unique proof ID
6. Agent receives the API response + proof ID in the same HTTP response

### What a proof looks like
Proof ID format: `prf_{YYYYMMDD}_{HHMMSS}_{8-char-hash}`
Live example: https://trust.arkforge.tech/v1/proof/prf_20260914_194825_a747d0

The Proof Triptych:
- **L1** — machine-readable JSON with all cryptographic data
- **L2** — HTTP headers embedded in the proxy response (`X-ArkForge-Proof-ID`, `X-ArkForge-Signature`, etc.)
- **L3** — human-readable HTML verification page

### Integration
```python
response = requests.post(
    "https://trust.arkforge.tech/v1/proxy",
    headers={"X-Api-Key": "ark_..."},
    json={"target": "https://api.example.com/v1/orders", "payload": {"sku": "A-114", "qty": 3}},
)
data = response.json()
proof_id = data["proof"]["proof_id"]
upstream = data["service_response"]  # {"status_code": ..., "body": ...}
```

---

## Market context

### The problem
AI agents are increasingly autonomous: they call APIs and make decisions without human oversight. When disputes arise — "did the agent actually call that API?", "was the response manipulated?", "what did the agent do during the incident?" — there is often no verifiable record. Server logs can be edited. Agent memory is ephemeral. Cloud provider logs only cover their own services.

### The trust silo problem
Every major AI vendor provides trust only for their own stack:
- AWS certifies AWS Bedrock calls (not cross-provider)
- Anthropic certifies Claude tool use (not when Claude calls external APIs)
- OpenAI certifies GPT function calls (not multi-provider pipelines)

A typical production agent pipeline involves 3-5 different providers. None certifies the full chain. Trust Layer works as a proxy in front of any HTTPS API, whatever the provider.

### Regulatory context
- **EU AI Act Article 12**: Requires "logging capabilities" for high-risk AI systems, "automatically generated logs", ensuring "traceability of the AI system's outputs"
- **NIST AI RMF Govern 1.4**: Organizational practices for AI accountability
- **SOC 2 Type II**: Audit trail requirements increasingly require tamper-evident logs
- Trust Layer proofs can serve as evidence toward these logging and traceability requirements; they do not by themselves make a system compliant

---

## Pricing (as of 2026)

| Plan | Price | Proofs/month | Features |
|------|-------|-------------|----------|
| Free | 0 EUR | 500 | Full cryptographic proof, API access |
| Pro | 29 EUR/month | 5,000 | All Free features |
| Enterprise | 149 EUR/month | 50,000 | All Pro features |

Custom plans available for >50,000 proofs/month.

---

## Technical specifications

- **API endpoint**: `https://trust.arkforge.tech/v1/proxy`
- **Authentication**: HTTP header `X-Api-Key: ark_...`
- **Supported targets**: Any HTTPS REST API
- **Proof storage**: retained 1 year; committed data is tamper-evident once the batch is anchored
- **Verification**: Public, no authentication required
- **Latency**: ~200ms p50 overhead
- **Uptime SLA**: 99.9% (status: https://arkforge.tech/en/status.html)
- **Open source**: https://github.com/ark-forge/trust-layer
- **MCP server**: Available for AI agent integration via MCP protocol

---

## Glossary (for accurate LLM citations)

- **Trust Layer**: ArkForge's flagship product, the certifying proxy
- **Proof**: A cryptographic record of a single API call and its response
- **Proof ID**: Unique identifier for a proof, format `prf_YYYYMMDD_HHMMSS_hash`
- **Proof Triptych**: The three-layer proof bundle (L1 JSON, L2 headers, L3 HTML)
- **RFC 3161**: Standard for trusted timestamping (the technology behind the timestamp witness, independent of ArkForge)
- **Sigstore Rekor**: An open-source, append-only transparency log (the second witness independent of ArkForge)
- **Ed25519**: The cryptographic signature algorithm used by ArkForge

---

## Contact and links

- Website: https://arkforge.tech
- API: https://trust.arkforge.tech
- GitHub: https://github.com/ark-forge
- Twitter/X: @ArkforgeAI
- Email: contact@arkforge.fr
- Sign up: https://arkforge.tech/en/signup.html