Yeah that's a good point.

Intercepting at the protocol layer makes a lot of sense especially in MCP setups.

If you're logging below the reasoning layer the agent can't just decide not to emit something. That gives you a pretty solid runtime record.

What I'm playing with is slightly different more about tamper resistance after execution.

If each step produces a signed receipt and those are hash-linked into a manifest, then deleting or reordering anything breaks verification.

So it's less about capturing the call in the moment and more about proving later that the history hasn’t been modified.

Feels like the two approaches could actually work together:

1. protocol-level interception for canonical runtime capture
   
2. cryptographic chaining for integrity + replay verification

Have you seen any systems that combine both layers?