How do I give a client verifiable evidence of which tools an AI agent called during a run, without handing over the arguments, results or secrets?

What should I check, step by step?

1. Take the calls from the layer that actually executes tools (your MCP client, gateway or tool runner), not from the model's narration. The model can describe a call it never made or leave one out.

2. For each call record: seq (1, 2, 3 in execution order), tool name, server or provider, call id, started_at, outcome (ok, error, denied), and whether a human approved it. OpenTelemetry's execute_tool span convention requires gen_ai.tool.name and uses gen_ai.tool.call.id, with arguments and results as opt-in content, which is a good model for what's safe to show.
3. For arguments and results, store a salted hash instead of the content: generate a fresh random salt per call (at least 128 bits), then SHA-256 over the salt plus the canonical JSON of the arguments (RFC 8785). Do the same for the result. Keep the salts and the originals privately.
4. Write the manifest as one canonical JSON line per call, sorted by seq, and add a header with the run id, the tool list the agent was allowed to use and the count of calls. Take SHA-256 of the whole manifest file.
5. At the end of the run, seal the manifest hash and call count in a signed run record (with record_ai_run, in params). Do it before you send the client anything, so the record's time comes before the delivery.
6. Send the client the manifest file and the receipt id. They check that the manifest hashes to the value in the record, then read the tool names, order and outcomes directly.
7. When the client asks about a specific call, send that call's arguments (or result) and its salt. They recompute the salted hash and compare it with that line of the manifest. Nothing else in the run is revealed.
8. Never put tokens, API keys or personal data in the manifest in clear text. If a value matters to the client, it goes in through the salted hash and is disclosed only if needed.

Why isn't an AI agent's own transcript evidence of which tools it called?

A transcript or chat log is written by the same system whose behaviour is in question, and it's easy to edit. A tool-call record written by the code that runs the tools, and sealed by someone else at the end of the run, is a much stronger basis for what the client is told.

• The MCP specification's tools page tells clients to log tool usage for audit purposes. Every MCP tool call is a tools/call request naming the tool and carrying its arguments, so a client or gateway sees each call in a uniform shape it can record.
• A sealed manifest answers the questions a client usually asks: which tools ran, in what order, which failed or were denied, and whether anything outside the agreed tool list was called. It doesn't need to show what was sent to each tool to answer them.

How do salted hashes let me reveal one AI agent tool call without the rest?

A plain hash of a short argument (a customer id, a yes/no flag, a small amount) can be reversed by hashing every likely value. SD-JWT (RFC 9901) solves the same problem for identity claims by hashing each disclosable value together with a random salt and sending the salt only when the value is disclosed. The manifest uses the same idea per call.

• Because each call has its own salt, revealing one call tells the client nothing about the others. If you'd rather prove one call's inclusion without sending the whole manifest, put the call hashes in a Merkle tree and seal the root; RFC 6962's Merkle audit paths show how one entry is proven against a root.
• Salted hashes don't hide everything: the tool names, order, timing and outcomes are visible by design. If even a tool name is confidential, replace it with a salted hash too and agree with the client which fields are open.

What can a client verify from a sealed AI agent tool-call manifest?

Can verify: the manifest they hold is the one sealed at the end of the run (verify_ai_run on the receipt, then recompute params_sha256 from the params object you give them and the manifest hash inside it); the record's signature and ledger entry (offline with the published key, or ledger_verify); and any call you choose to open.

• Can't verify: that your tool layer recorded every call. A complete manifest depends on capturing calls where they execute. If the client needs that assurance, a gateway they or a third party control is the stronger set-up.
• The record also doesn't show that the tools worked correctly or that the agent's output is right. It shows what was called and that the list hasn't changed since it was sealed.