Notary — Development skill for Claude Code

notary

**A black-box recorder and approval gate for any Claude skill. Signed, tamper-evident, human-approved execution receipts. Drop-in MCP server, no infra, under 1,500 lines.**

A solicitor lets an AI skill read a client matter, draft a clause, flag a risk. Later someone asks: what was that skill *allowed* to touch? Did a qualified human *approve* it before it ran? Can you prove the record of what happened has not been edited since?

In a regulated setting — legal, finance, healthcare — "trust me, it logged it" is not an answer. `notary` makes the answer provable.

Point it at a skill folder. It checks the skill's declared permissions against what you granted, optionally pauses for a human to approve, runs it, and writes an **Ed25519-signed, hash-chained receipt** of everything that happened. Anyone with the public key can verify a receipt is genuine. **Nobody can forge, alter, reorder, or truncate a sealed receipt without the private signing key.**

No database. No auth server. No dashboard. No hosting. Those are your job, and that is the point. notary works for any Claude skill; legal is where the receipt matters most.

**Audit quality → audit security → notarise execution.** [skill-auditor](https://github.com/b1rdmania/claude-skill-auditor) checks whether a skill is any good; [skill-security-audit](https://github.com/b1rdmania/skill-security-audit) checks whether it is safe to run; `notary` proves what it was allowed to do, and that a human approved it, every time it runs.


What a run looks like

$ notary run examples/skills/contract-review --doc nda.txt
✓ skill loaded: contract-review
✓ gate: declared [fs.read, model.call] ⊆ granted [fs.read, model.call]
? approve "contract-review" to run with [fs.read, model.call]? [y/N] y
✓ approved by cli
… running …
─ output ───────────────────────────────────────