Capture
A change ships — a new prompt, a swapped model, an edited policy — and it is recorded at the moment it happens, not written up afterwards by hand.
Install the SDKThe black boxfor AI.
Every change your AI makes — prompts, models, policies, tool grants — captured the moment it ships, sealed with post-quantum signatures, and verifiable by anyone, offline, across any provider.
~/refund-agent $ COOL_REQUIRE_HARDWARE=1 cool verify receipt.json
reading receipt · Phala Cloud · Intel TDX
✓ binding
✓ signature
✓ inclusion
✓ consistency
✓ witness
✓ attestation
✓ enclave
VERIFIED 7 / 7 domains · hardware required
Real output shape of the open verifier. Binding, signature and inclusion verify fully offline; attestation is checked against Intel TDX quotes from Phala Cloud — evidence published in the SDK repo.
Demo
See it in action.
A short walkthrough of CooL sealing a change and verifying it.
Product
Three pieces: capture, log, verify.
CooL sits beside the AI you already run. When something about it changes, CooL records it, locks it into a log nobody can quietly rewrite, and gives you a receipt anyone can check.
Log
Records are appended to a Merkle log built the way Certificate Transparency builds one (RFC 6962). Tampering isn't prevented by access control — it's made detectable by anyone.
How the log holdsVerify
Anyone can check a receipt on their own machine — no CooL account, no network call, nothing of ours in the loop. Trust the maths, not the vendor.
Verify it yourselfGet started
From install to a verified record in five minutes.
You need Node 20 or later and an app that already calls a model. CooL wraps a call you already make — it doesn't add a new one.
Install the SDK and CLI
One package gives you the library, the cool command and the offline verifier. Prefer not to use npm? Download the tarball directly and check it against the published SHA-256 checksums.
$ npm install -g cool-nwc $ cool --help # or add it to your app as a library $ npm install cool-nwc
Wrap your existing model call
CoolTee.connect starts the evidence plane — the part that hashes, signs and logs. On a laptop or in CI it runs against a built-in simulator, so nothing needs real hardware yet. Your backend function is your inference call, unchanged; if the evidence plane is unavailable, your completion still returns.
import { CoolTee } from "cool-nwc"; const cool = await CoolTee.connect({ app: { name: "refund-agent", imageDigest: process.env.IMAGE_DIGEST! }, backend: async ({ model, prompt, params }) => ({ output: await yourModel(model, prompt, params), }), });
Record a change
A change is anything that alters how your AI behaves. One call hashes it with SHA-256, signs it with ML-DSA-65 + Ed25519 and appends it to the log. From a terminal or CI it is one command. Kinds: prompt, model, params, policy, dataset, agent-permission, tool.
await cool.change({ kind: "prompt", ref: "billing/refund-agent#system", before: previousPrompt, after: nextPrompt, actor: { id: "ci:github-actions", method: "oidc" }, }); # the same thing from the CLI $ cool seal prompt billing/agent#system "Approve refunds up to $500."
Check it like a stranger would
No account, no network call. All seven checks should print pass — or simulated for attestation, because you aren't on real hardware yet. That's expected, not an error.
$ cool verify last $ cool verify all # exits 1 if any record fails $ cool verify ./receipt.json --json
Move to real hardware
Run CooL inside an Intel TDX confidential VM on Phala Cloud. The deploy/ folder contains the container image, compose file and dstack manifest. Point it at a quote verifier and pin the measurement, and attestation moves from simulated to pass. There is no signing key to configure — it is derived inside the enclave, which is why CooL cannot forge your records.
# 1. get a confidential VM $ cd deploy $ phala deploy -c docker-compose.yml -n cool-evidence # 2. give it a vendor root to check against $ export QUOTE_VERIFIER_URL=https://api.phala.network/attest/verify # 3. confirm, then refuse anything simulated $ cool status $ cool verify last --require-hardware
Founders
Applied post-quantum cryptography and confidential-compute inference.
Founder & CEO
PranauvShrinaath S
Post-quantum cryptography · blockchain
ipsec-pqc-ikev2— published research mapping ML-KEM into IKEv2 (liboqs / C)- Research on decentralising public banks, secured with PQC + Hyperledger Fabric
- Onsite research internship, NUS Singapore
- Building since 14
Co-Founder & CTO
KailoshKalimuthu
Trusted execution environments · AI inference
- Built BIFROST — a decentralised P2P comms / storage / compute network
- Repurposes idle hardware into an encrypted, distributed micro-cloud
- 6 months building with US startup Decipher
- Building since 16
FAQ
Questions, answered.
Can't find what you need? The documentation goes deeper, or talk to the founders directly.
Every change to how your AI behaves, and never your users' data.
A change to the behaviour of an AI system: an edited prompt, a swapped model, a changed policy, a granted tool. Each one is serialised deterministically, hashed, signed, and appended to a transparency log. It records the change, not your users' data.
Anyone can check a receipt on their own machine, with the internet switched off.
You take a receipt file and run the open verifier on your own machine, with the network switched off. It recomputes the digest, checks the signature, checks the inclusion path and the consistency of the log. Nothing of ours is contacted, so nothing of ours has to be trusted.
Intel TDX confidential VMs on Phala Cloud.
Intel TDX confidential VMs on Phala Cloud, through dstack. All seven checks have been verified on that hardware, with the raw quotes and tamper tests published in the SDK repo. Limits, stated plainly: CPU TDX only, no GPU attestation claimed, and quote verification goes through Phala's service unless you supply collateral locally. With COOL_REQUIRE_HARDWARE=1 the verifier fails closed rather than downgrading to simulation.
No. Your model stays where it runs today.
No. Your model runs wherever it already runs, on whichever provider you already use. CooL sits beside it and records what changed. That neutrality is the point — a system of record tied to one vendor cannot be the system of record.
Because records have to stay trustworthy for years, longer than today's signatures may last.
Because evidence has a long shelf life. A record sealed for a seven-year retention obligation has to survive the whole seven years, and "harvest now, verify later" is a real problem for signatures that outlive their assumptions. Hybrid ML-DSA-65 + Ed25519 holds if either scheme is broken.
Yes. Install it with npm i -g cool-nwc.
npm i -g cool-nwc is published and installs the SDK and verifier; the source is on GitHub under BUSL-1.1. Automatic capture is the active build. Launch prices are on the pricing page, but billing is not live yet, so there is nothing to buy today.
A product you check, not one you're asked to believe.
Book a call and we'll walk a change you'd want on the record through end to end — or install the SDK and check it yourself.