Verifiable multi-agent consensus for Claude.

Three specialists. One signed answer. Disagreement surfaced, not averaged away — and every result lands as a tamper-evident receipt any agent, auditor, or future teammate can verify.

$ pip install claudeway
Not a blockchain. / Not a token. / No ledger. / Just Ed25519 + a pub/sub relay.
Live on Nostr · nostr.mom/e/583be95c… · BIP-340 verified · 5 relays
hello.py
from claudeway import (
    AgentConfig, Swarm, SwarmConfig, Task,
)

swarm = Swarm(SwarmConfig(
    name="ArchReview",
    agents=[
        AgentConfig("StrongConsistency", "Distributed Systems Engineer", "..."),
        AgentConfig("Operations", "SRE / Platform Lead", "..."),
        AgentConfig("Pragmatist", "Staff Engineer", "..."),
    ],
), api_key=...)

result = await swarm.process(Task(
    id="q1",
    description="Active-active Postgres or eventual consistency?",
    input_data={},
))

# Three specialists. One signed answer.
# Disagreement surfaced, not averaged away.
print(result.result["final_answer"])
print(f"agreement: {result.result['agreement']:.0%}")
164 tests · 97% on critical-path
4 base deps
3 transports
2 signature backends
+7/20 blind-judge quality lift
live on Nostr
// Features

Everything you need to ship signed agreement.

One SDK, four adapters, three transports, two signature backends. Pick what you need; the rest stays out of your pip install.

// why 3 agents?
2 is a tie. 3 is the smallest panel where disagreement is meaningful and the majority is non-trivial. N is configurable — pass more AgentConfig entries and the swarm scales.

Python SDK

Swarm, Coordinator, Agent — concurrent by default. Async-first, prompt-caching-friendly. 4 base deps.

pip install claudeway

MCP server

One binary. Any MCP-capable agent — Claude Code, Cursor, Goose — gains reach_consensus as a tool.

pip install claudeway[mcp]

Coordinator

Hierarchical decomposition. Planner agent emits a JSON plan with dependencies; specialists run in parallel where independent.

claudeway.coordinator

3 transports

One signed receipt renders as plain JSON, a W3C Verifiable Credential, or a Nostr NIP-78 event any client can read.

JSON · VC · Nostr

Post-quantum ready

Same receipt, same canonical hash. Swap Ed25519 for ML-DSA-65 (FIPS 204) at the SignatureBackend ABC — no consensus code changes.

pip install claudeway[pq]

Streaming + transparency

Watch each agent land in real time. Every consensus event appended to an RFC 6962 transparency log, anchored to Nostr on a cadence.

observable
// Built for

Any agent system that needs agreement, not just answers.

Claudeway plugs in wherever an agent stack needs a verifiable consensus primitive — as a Python SDK, an MCP tool, a coordinator, or a signed receipt on the wire.

Agent frameworks

Drop signed consensus in as a primitive. Your orchestrator calls Claudeway; your users get a tamper-evident receipt with disagreement surfaced. Lazy-imported adapters keep your core dep-light.

adapters →

MCP-first clients

Any MCP-capable client — Claude Code, Cursor, Goose, your own — gains reach_consensus and verify_consensus as tools. One binary. Zero framework to learn.

MCP server →

Production AI systems

Replace "ask once and trust it" with "ask three specialists, sign the result." Every decision becomes a tamper-evident artifact — auditable, replayable, and impossible to silently rewrite.

concepts →

Compliance & audit

Every consensus event appended to an RFC 6962 transparency log, anchored to Nostr on a cadence. Hand the receipt to an auditor, regulator, or future teammate — they verify without trusting you.

threat model →
// When to use it

For decisions worth defending.

Claudeway isn't for every Claude call. It's for the calls you might have to justify later — to an auditor, a co-founder, a regulator, or your future self. Three real patterns from the examples.

Architecture decisions

"Should we go active-active Postgres or eventual consistency for payments?" Three specialists answer in parallel. If they disagree, a Debate round surfaces the gap before you commit.

if not r1["disagreed"]: print("Agents agreed.") return print("Disagreement flagged. Debate...") r2 = await run_round("Round 2", build_swarm(Debate()))

Compliance & audit trails

Every consensus is appended to an RFC 6962 Merkle log; the log root anchors to Nostr on a cadence. A third party can verify a receipt was in the log — and detect tampering — without trusting Claudeway.

log = TransparencyLog(name="claudeway-canonical") for rc in receipts: log.append(rc) proof = log.inclusion_proof(1) ok = TransparencyLog.verify_inclusion( target, proof, log.root )

Your existing agent stack

Already running LangGraph, CrewAI, MAF, or your own orchestrator? Claudeway drops in as one node — no rip-and-replace, no rewrite. Signed consensus as a graph primitive.

consensus = make_consensus_node(build_swarm()) builder = StateGraph(MyState) builder.add_node("research", research_node) builder.add_node("consensus", consensus) builder.add_edge("research", "consensus")
// Architecture

Four layers. Each independently swappable.

The signature surface is the moat. Everything below it is the SDK; everything above it is how you deliver the signed receipt to the systems that consume it.

Transports claudeway.transports
One signed receipt, three wire formats. Change transports without re-signing.
to_json_receipt
to_verifiable_credential
to_nostr_event
Signing · the moat claudeway.signing
ConsensusReceipt — canonical, signed payload. SignatureBackend ABC isolates the crypto; consensus code is untouched either way.
Ed25519Backend
MLDSABackend (PQ)
canonical_json
Consensus claudeway.consensus
Pluggable aggregation. WeightedVote for cheap default. Debate for hard questions — agents see peers and revise.
ConsensusStrategy
WeightedVote
Debate
Core claudeway.swarm / coordinator
Concurrent (asyncio.gather, not serial). Agent calls in parallel; tools/MCP lazy-imported.
Swarm
Coordinator
Runtime · Agent
Each layer depends only on the one below Swap any layer without touching the others.
// The real differentiator

Not just an ensemble.

Ensembles average N model calls into a single confident answer. Claudeway records the disagreement, signs it, and ships the trace alongside the verdict.

// Ensemble pattern

Confident mush.

agent_1 "use Postgres"
agent_2 "use Postgres"
agent_3 "use Postgres"
vote "Postgres" (confidence unknown)
answer no trace of why
What you get: a single answer with no record of who said what, where they diverged, or whether the agreement was real or pressure-free.
// Claudeway

Signed debate, surfaced.

Dba "use Postgres" · conf 0.82
Indie "use SQLite — ops cost" · conf 0.71
Security "use Postgres" · conf 0.78
debate Indie sees peers, revises → Postgres
receipt final + per-agent + disagreement · signed
What you get: the verdict, every agent's full response, the disagreement flagged in the signed payload, and a tamper-evident receipt you can hand to anyone.
// Live on the wire

Not a screenshot. The actual signed artifact.

Three Claudeway agents ran a real Debate consensus. The result was signed with Ed25519, wrapped as a NIP-78 Nostr event, and published to four public relays. Verify the signature yourself.

The receipt

Kind 30078 (NIP-78 addressable). BIP-340 Schnorr signature over sha256 of the NIP-01 serialization. Anyone with the event JSON can verify — no Claudeway runtime required.

Open in any Nostr-capable client — Damus, Snort, Primal, or your terminal. Or verify it right here in your browser:

CLI equivalent: nak verify < event.json
event_id: fetching… kind: pubkey: created_at: sig_scheme: BIP-340 Schnorr (secp256k1) content: algorithm: payload_hash: agent_count: agreement: disagreed: relays (live): connecting… awaiting fetch…
// Result
?
Awaiting input.
Crypto runs client-side via @noble/curves. No server round-trip, no event leaves your browser.
// Live event is pre-loaded above. Click Verify signature → to confirm the BIP-340 Schnorr signature against the live relay data.
// Honest tradeoffs

What this costs — and when to skip it.

Claudeway isn't free. The benchmark uses 36× the tokens of a single Claude call and runs 4× slower (29.8s vs 7.5s, same model).

// rough cost per consensus call
cheap path  3 agents · WeightedVote · Haiku · 256 tok  →  ~$0.01
debate path  3 agents · Debate · Haiku · 1k tok    →  ~$0.30
premium      3 agents · Debate · Sonnet · 2k tok   →  ~$1.50
// 100 questions/day at debate path ≈ $90/mo. Use it for what's worth it.

Use it when

  • The cost of being wrong exceeds the cost of the consensus.
  • A future auditor, regulator, or teammate will ask "why did the AI say X?"
  • The decision is high-stakes, contested, or legally meaningful.
  • You need disagreement surfaced — not averaged into a hedge.
  • You need to self-host — the only outbound call is to Anthropic. No Claudeway backend, no telemetry, no shared state.

Why not just write this yourself?

You can. The core consensus logic is ~50 lines. But:

// Security

Every claim here is verifiable in five minutes.

No third-party audit yet — Claudeway is brand new. Until auditors catch up, here's what you can check yourself, and what's still on you.

What's defended

  • 17 adversarial tests across 7 attack classes — signature, payload, public key, hash tampering; replay; task substitution; single-key compromise; swarm poisoning; canonical-JSON equivocation; Nostr transport tampering.
  • Receipt forgery. Tamper any of the four signed surfaces — even one hex nibble — and verification breaks.
  • Task substitution. task_id and swarm are inside the signed payload. A receipt from task-A will not verify as task-B's result.
  • Swarm poisoning visibility. When N-1 of N agents lie, the disagreement is recorded verbatim in the signed payload. Poisoning is visible, not laundered.
  • Retroactive answer-editing. Once signed, the answer can't be silently rewritten.

What isn't (yet)

  • Agent identity. Three "specialists" could be one process in three hats. Claudeway signs the consensus, not the agents.
  • Agent correctness. Confident lies are recorded as confidently as confident truths. Verification proves the receipt is intact — not that the answer was right.
  • Signing-key rotation. No revocation, no forward secrecy (yet).
  • Post-quantum signatures. Ed25519 and BIP-340 are classical. The ML-DSA-65 backend ships for forward-looking use; whether to switch is yours to decide.
  • Relay delivery. Nostr relays can reorder or drop events. The signature defends integrity, not delivery.
Read the threat model → Read the adversarial tests →
// Longevity & lock-in

If Claudeway disappears tomorrow, your receipts still verify.

The signed artifact is self-contained. Verification doesn't need Claudeway installed, doesn't need a server, doesn't need me. The canonical payload is documented; the cryptography is standard.

No lock-in.

Receipts are plain Ed25519 signatures over a canonical JSON payload. Verify with nak, OpenSSL, or a 20-line Python script. No Claudeway runtime required.

echo $payload | nak verify

MIT, forever.

The SDK is MIT-licensed and will stay MIT. No BSL rug, no SSPL switch, no "Open Core" carve-out. If a hosted tier ships later, the SDK stays MIT — the SDK is the receipt format, not a sales funnel.

LICENSE: MIT · Copyright (c) 2026 Jordan Newell

Pre-1.0 honesty.

Currently v0.3.x. Public API may shift. 1.0 ships when the signature surface is locked — at that point, canonical payload, receipt shape, and verifier interface freeze. Until then, semver-minor breakage is fair.

v0.3.2 · 5 days old · 40 commits

Ship a signed consensus receipt in under two minutes.