Lyhna Desktop · a local receipt layer for your agents
Run your agents. Walk away. Come back to receipts.
Lyhna Desktop gives people running agents readable AI Work Receipts, backed by witnessed evidence.
You let your agents work while you weren't watching. Can you trust what they say happened? Lyhna shows you what the agent claimed, what was witnessed, what was missing, and what needs review.
Local by default. MCP-compatible — works with agents that can route through Lyhna: Claude Code, Codex, Cursor, Ollama and local models, and more.
Buy once. Use with all your agents.
Lyhna Desktop is a local app you own — not another hosted cloud system that bills every call.
Buy once
One purchase, not a meter running in the background. No per-action billing on your own machine.
Use with all your agents
Every agent you route through Lyhna earns receipts — one app across your whole setup.
Unlimited local receipts
Witness and render as many runs as you want. The receipts are generated on your machine.
Your receipts stay yours
Receipts land in a local receipt inbox. You export the capsule when you decide to.
Bring your own agents, keys, and tools.
Your agents keep using your existing providers, local models, tools, keys, and workflows. Lyhna doesn't pay for your model usage, doesn't host your agent work by default, and doesn't run or orchestrate your agents.
Your agents use your keys, models, and tools. Lyhna gives you the receipts.
What one run produces.
A single witnessed run packages into one capsule. Open the receipt first — the rest are copies for your software, the next agent, and your knowledge and memory systems.
HANDOFF.md
For you. What the agent claimed, what crossed the tool boundary, what's unsupported, and what's safe to continue.
handoff.json
The same receipt as structured data — per-step claimed-vs-witnessed pairs and verdicts your software can read.
CAPSULE.md · capsule.json
The bundle's table of contents — names every file and the trust boundary it carries. It explains the capsule; it asserts nothing new.
next-ai-prompt.md
A safe hand-off for the next AI: what's confirmed, what to re-check, and what not to trust yet.
okf/
An Open Knowledge Format projection — portable, agent-readable, every step carrying its evidence label.
pam/
A PAM-shaped memory copy the next agent can carry — each item keeps its evidence status, so an unsupported claim never becomes a fact.
where available
When a signing key is attached, receipts carry verifiable references anyone can check offline. Trust under the hood — you don't have to read it.
Every copy carries the same verdicts. None of them upgrades an unsupported claim into a fact.
How Lyhna Desktop works.
A local app, a local adapter, a local receipt inbox, and an export you control.
-
1 · Local adapter
Lyhna Desktop starts and controls the local Lyhna MCP adapter on your machine.
-
2 · Agents route through Lyhna
Your agents send their tool calls through the adapter, with your own keys, models, and tools.
-
3 · Receipts appear in your inbox
Each witnessed run lands in your local receipt inbox — claimed vs. witnessed, with verdicts.
-
4 · Export when you want
Export the receipt, the Work Receipt Capsule, and the proof references it carries — on your terms, when you choose.
Honest status: the MCP adapter, the receipt renderer, and the capsule exports already exist in this repo (connect an agent today). Lyhna Desktop packages that receipt layer into a local app — the app itself isn't a download yet, and we won't pretend it is.
Your agent's word, checked against its work.
Every receipt separates the story from the evidence.
The agent claimed it. The tool call was witnessed.
The agent claimed one thing. The witness saw another — review before relying on it.
The agent claimed it. No tool call backs it up. Don't put this in front of a client.
Lyhna witnesses. It doesn't run your agents.
Lyhna sits in your agent's tool path and witnesses the calls routed through it. It doesn't drive your agents, and it can't see what isn't routed through it — anything outside that path is marked unwitnessed, never assumed.
And when evidence is missing, Lyhna doesn't block your agent — it blocks the claim from becoming trusted. The receipt marks it unsupported instead of giving it a pass.
It tells you less than other tools. On purpose.
Lyhna will never tell you the email was delivered, the work is correct, or the client was happy. It can't witness those things, so it won't claim them.
It tells you exactly one thing, and tells it true: what your agent did at the tool boundary — what it claimed, and what was witnessed. Every label is tied to what was witnessed, what was not, or what stayed outside the observed workflow.
Memory moves. Lyhna checks it first.
The industry is racing to move agent memory between tools — OKF, PAM, Mem0, and whatever's next. They make memory portable.
Lyhna makes it honest.
It marks what crossed the tool boundary — and what didn't — before the memory travels. The carrier is a consumer of Lyhna. It is not Lyhna.
Don't take our word for it. Don't take the agent's either.
Run the demo. Watch the loop replay, and the receipt print. Then copy it, paste it into your own AI, and ask: does this overclaim? It should come back with the same boundary the receipt draws — what was witnessed, what was unsupported, and what stayed outside the observed workflow.
Run the demo