TokenForensics.ai

Introduction

TokenForensics.ai is the forensic investigation layer for production LLM and agent systems. It sits downstream of any AI gateway and complements any observability tool — it does not compete for the capture point, it owns the investigation layer above it.

The category, in one line

Observability watches. Gateways control. TokenForensics investigates — with chain-of-custody, tamper-evident capture, replay, and attribution. Evidence that is admissible, not just informative.

The forensic substrate

Everything in the product is built on one primitive: a hash-chained, append-only TokenAuditEvent ledger. Every forensic-relevant action is a new event whose hash covers the previous event's hash, so the record is tamper-evident by construction — you cannot reorder or rewrite history without breaking the chain.

Forensic significance

The hash chain is the chain-of-custody. A single mutation breaks tamper-evidence for everything after it. The ledger is append-only — no updates, no deletes, ever.

How the product is built — three tracks

TokenForensics is built along three parallel tracks. A capability is only "done" when all three have shipped for it.

  • Feature build — the capability itself: the eight forensic pillars on top of the TokenAuditEvent substrate.
  • UX Foundation — the design system, theming, app shell, and component library every pillar's UI is built on. UX ships with each feature, not after it.
  • Docs & Video — this documentation site and a Remotion video walkthrough for every feature. A feature page without a walkthrough is not finished.

How these docs are organized

  • Getting started — what the product is and how to find your way around.
  • Features — every shipped capability: what it does, the surfaces it appears on, and an embedded video walkthrough. Each feature page links back to its roadmap entry and implementation plan.
  • Infrastructure — the wired-up plumbing (billing, email, observability, model clients), documented like everything else.
  • Reference — the open standard: the Token Forensics Exchange Format and its conformance levels.

This documentation is a living library: it grows, changes, and is pruned in lockstep with the product. When a feature changes, its page and its walkthrough change in the same pull request; when a feature is removed, its page goes with it. Every page carries a "last updated" date so you can see how fresh it is at a glance.

Tip

Press ⌘K (or Ctrl K) anywhere in the docs to search — it matches the full text of every page, not just titles and headings, so a word that only appears in the prose is still findable.

Last updated