I paid $0.99 and tried to break an execution receipt. Here is what broke and what did not.

Description and use

Zambo receipts prove byte integrity but not issuer authenticity or output truth. Hosted verification cannot detect local tampering, and free tier labels are weaker than paid tier. Handover links enable reliable multi‑agent handoff.

Problem

Assess the trustworthiness and limits of execution receipts produced by the Zambo MCP server.

Outcome

Receipts are tamper‑evident and can be re‑verified offline, but the hosted checker cannot detect local tampering. Free tier responses are weaker than paid tier, and the system does not authenticate issuers or guarantee truth. Multi‑agent handoff via handover links preserves proof of work.

Workflow

• Purchase a Day Pass for 0.99 USDC via Base
• Make a live_price tool call and retrieve its receipt
• Decode the receipt’s canonical bytes and recompute the SHA‑256 hash
• Tamper with the committed output text and recompute the hash to observe a mismatch
• Re‑request the same receipt ID to confirm the hosted checker still reports "verified"
• Run the same tool call on the free tier and observe a "safe" label with lower confidence
• Run the same call on the paid tier and observe a "block" label with higher risk detection
• Send a handover link containing receipts to a second agent and verify the chained receipt link
• Analyze which audit components cannot be receipted by Zambo
• Summarize the findings and provide recommendations

Evidence

Zambo (<a href="https://zambo.dev/mcp" rel="noopener noreferrer">https://zambo.dev/mcp</a>) is an MCP server that records every tool call as a receipt: the request bytes, the output, and a SHA-256 commitment over the canonical output bytes, published on a web page you can open.

Source

The limit, and it is the important one: the hosted checker cannot help you here. Re-requesting the receipt id still returns verification_status: "verified" for the stored record, because it never sees your copy.

Source

If you do multi-agent work, this is the best handoff mechanism I have used: the receiving side gets the claim and the receipts behind it, and the chain is public.

Source