Netskope · One Agentic Broker · MCP Receipts · PQ-Identity

Netskope One PQ-Identity Vault.

Every MCP transaction the Agentic Broker secures deserves a dual-signed receipt that survives 2031. Hive ships the receipt rail underneath.

The exposure

Netskope One Agentic Broker

Every MCP transaction visible

Netskope CTO PQC paper (June 2025)

ML-KEM 768 chosen for TLS key agreement

Netskope OpenSSL 3.5 path

PQC rolling out 2H 2025+

AgentSkope (May 2026)

Autonomous SOC/NOC agents acting on enterprise data

Per-MCP-transaction receipts in place

Zero

NIST IR 8547 disallowance

2035 (classical)

Settlement rail

USDC · Base 8453

Identity layer

did:hive:agent:<uuid> resolves to dual-signed receipt envelope

Thesis

Netskope sees and governs the agent traffic at the SASE perimeter, inside the AI Gateway, and across MCP servers. What Netskope does NOT produce today is a per-action, dual-signed (Ed25519 + ML-DSA-65), court-grade receipt that survives 2031.

Hive is that receipt layer.

Two complementary primitives:

Netskope: perimeter visibility and traffic control
Hive: per-action evidence and provenance

Same NIST PQC stack. Same compliance horizon. Different layer in the agentic stack.

Per-MCP-call dual-signed evidence receipt

Every MCP call brokered through Netskope One Agentic Broker can carry a receipt envelope signed off-chain with Ed25519 and ML-DSA-65 for offline verification. Any chain anchor must be separately selected and specified.

Per call

receipt granularity

every MCP transaction

sig algorithms

Ed25519 + ML-DSA-65

Base 8453

anchor chain

USDC settlement rail

2031+

verifiable through

PQ-survivable receipt

Sample receipt envelope · illustrative · field shape only

{ "agent_call": { "mcp_server": "netskope-agentic-broker.corp.example", "tool": "query_dlp_policy", "args_hash": "sha3-256:7f4a...b291", "ts": "2026-05-08T15:12:34.007Z" }, "hive_receipt": { "did": "did:hive:agent:3f9e2c1a-bd47-4e88-a011-7c6d5b1e0f34", "ed25519_sig": "<base64-64-byte-Ed25519>", "ml_dsa_65_sig": "<base64-3309-byte-ML-DSA-65>", "key_id": "did:hive:agent:3f9e2c1a-bd47-4e88-a011-7c6d5b1e0f34", "doctrine": "real-rails-only-pq-2031-survivable" } }

Configure · Calibrate · Receipt

Dial in your shape, then run a real receipt.

Pick the model your agents run, choose your MCP volume and your preferred breach-cost benchmark, then click Run a receipt. The page hits the live Hive endpoint and renders a real cert_id with Ed25519 + ML-DSA-65 signatures back to you in under two seconds. No account, no SDK, no API key.

Agent shape

Model

Deployment target

Tool grants

Provenance substrate

Wave-Lattice (axes 1 to 16): cosmic entropy substrate, the default mode for agent-payment receipts.

Volume & benchmark

MCP calls / day

50,000

Breach-cost benchmark

Custom breach cost (USD)

Uninvestigated alerts %

40%

Live calibration

MCP calls / year

18,250,000

at current daily volume

uninvestigated

7,300,000

no agent provenance trail

exposure (1 breach @ benchmark)

$4.44M

IBM 2025 global avg

hive receipt cost / year

$18,250

$0.001 per call · full coverage

curl · live preview · updates as you dial

curl -s -X POST https://receipts.thehiveryiq.com/v1/provebirth/cert/issue \
  -H "Content-Type: application/json" \
  -d '{ ... }'

Hits POST /v1/provebirth/cert/issue · production endpoint live

Receipt issued cert_id · ed25519 · ml-dsa-65 · latency

Every Netskope MCP transaction can carry the returned cert_id + dual-signature pair as the X-Hive-Cert-Id header. Counterparties verify against the federated block hash without calling back to Hive or Netskope. Sample tier is rate-limited to 30 issues / hour / IP. Production tier is x402-gated at $0.01 per receipt and emits full ML-DSA-65 (3309 bytes) coverage.

Beyond agent payments: supply-chain attestation

Netskope sits at the agent AI gateway. Loess-Lattice gives Netskope customers a second story: not just “we secure your agents” but “we attest where the data their agents touch was born: soil, water, air, animal, seed.”

Axis 17 · Soil · Axis 24 · Weather

Agentic data lineage

Netskope-secured agents carry Loess-Lattice receipts on every dataset they touch. Trace inference back to the soil sample, the seed lot, the herd. The receipt survives the agent handoff.

CSRD · SEC Climate Rules · Farm Passport

ESG / climate audit

CSRD and SEC climate disclosures need attested physical-world data. Loess-Lattice farm-level passports satisfy facility-level reporting at $1,000/yr per farm. Netskope brokers the receipts to auditors.

Pharma · Food Safety · Ag Insurance

Pharma + food-safety AI

AI models trained on food, agricultural, or biological data inherit provenance. Auditors verify the chain offline. No Hive dependency at verification time, just the receipt and the on-chain anchor.

The same primitive that secures your agents now attests where their data was born.

Compatibility: Netskope One product surface

Netskope One Agentic Broker

Read traffic, sign receipt before forwarding to data source. The broker sits in the MCP call path; Hive attaches the signed envelope at the broker intercept point.
Netskope One AI Gateway

Receipt envelope embedded in gateway audit log. Every AI interaction routed through the gateway carries a tamper-evident Hive receipt alongside the native gateway log entry.
Netskope One AI Guardrails

Guardrail decisions get receipts you can prove: who ran which check, when, and what the outcome was. The receipt binds the guardrail policy version to the decision event.
AgentSkope (launched May 2026)

Every autonomous SOC/NOC agent action signs a receipt before acting. No agentic remediation step executes without a court-grade identity trail.
Netskope ML-KEM 768 PQC stack

Netskope's TLS key agreement uses ML-KEM 768 (per Netskope CTO PQC paper, June 2025). The Hive receipt uses ML-DSA-65 from the same NIST post-quantum family. The two primitives work together, not against each other.

What you can build

Hive primitives available to Netskope-integrated agents today

prove.mRNAfree()

Threshold-signed attestation from farmer, processor, and inspector that the animal received no mRNA products. Signed with ML-DSA-65 and stamped with Loess-Lattice soil entropy from the farm of origin. For Netskope-secured agents surfacing provenance in food-safety or pharma AI workflows.
prove.cleanLabel()

Processing attestation signed by three agents (processor, inspector, third-party lab) certifying no synthetic additives from the regulatory-banned list. Purity Score reflects additive-free status. Satisfies CSRD Annex I supply-chain disclosure requirements when brokered through Netskope.
prove.purityChain()

End-to-end provenance chain for biological or agricultural datasets: seed lot to processor to model training run. Every CTE (Critical Tracking Event) gets a Loess-Lattice receipt. Auditors verify offline without contacting Hive or Netskope. The receipt JSON plus the on-chain anchor is enough.

Verify a Netskope receipt

Sample verification workflow

Any auditor, SOC analyst, or counterparty can independently verify a Netskope MCP receipt without contacting Hive or Netskope. The verification uses only: the receipt JSON, the agent DID document (publicly resolvable), and the separately selected and specified chain anchor.

Paste receipt JSON to verify

Verify

Clicking Verify forwards the receipt to thehiveryiq.com/prove-birth/ for offline signature validation with the published key; any separately specified chain commitment is checked independently. Post-2035, Ed25519 verification becomes optional; ML-DSA-65 carries the long-horizon trust.

Post-quantum readiness

Netskope PQC roadmap

ML-KEM 768 selected for TLS key agreement (Netskope CTO PQC paper, June 2025)
OpenSSL 3.5 dependency: PQC phased rollout 2H 2025 onward
Eventual PQC X.509 certificates replacing classical ECDSA certs
Aligned with NIST IR 8547 deprecation (2030) and disallowance (2035) horizons
ML-KEM 768 in the same NIST post-quantum family as ML-DSA-65 (CRYSTALS lineage)

Hive PQ-receipt complement

ML-DSA-65 signature on every receipt today (NIST FIPS 204, finalized August 2024)
ML-KEM 768 envelope encryption for receipt transport layer
Dual-signed Ed25519 + ML-DSA-65 for migration window compatibility
Receipts verifiable past 2035 disallowance without re-signing
Offline signature verification requires no central Hive dependency; any chain anchor must be separately selected and specified

NIST IR 8547 compliance horizon

ML-DSA-65 signed at issuance. Verifiable by auditors and courts post-2035 without re-signing.

Classical algorithm

Ed25519 (FIPS 186-5)

Post-quantum algorithm

ML-DSA-65 (FIPS 204)

NIST deprecation year

2030 (classical)

NIST disallowance year

2035 (classical)

Netskope TLS KEM

ML-KEM 768

ML-DSA-65 valid through

2055+ (est.)

NIST Interagency Report 8547 (November 2024 initial public draft) mandates the 2030 deprecation and 2035 disallowance of ECDSA, Ed25519, and RSA for new systems. A Netskope MCP receipt signed only with Ed25519 in 2026 will be unverifiable to an auditor in 2036 running on post-2035 infrastructure. Hive attaches ML-DSA-65 at issuance, so there's no re-signing needed when the epoch flips.

Source benchmarks behind the configurator

Public sources cited verbatim · the dial above interpolates between them

Uninvestigated SOC alerts

40%

40% of SOC alerts go uninvestigated. Cited to Netskope AgentSkope launch coverage, Network World, May 2026. AgentSkope was built to address this autonomous SOC gap.

Data-breach cost, no provenance trail

$4.44M

Average global cost of a single data breach. IBM Cost of a Data Breach Report, 2025, down 9% year over year from $4.88M. That's the largest decline in five years, thanks to faster identification and containment through security AI.

FSMA 204 addendum: For supply-chain breaches involving food or agricultural data, FSMA 204 (effective 2028) raises auditable-record requirements. Loess-Lattice receipts auto-populate KDEs at every CTE, meeting the traceability rule without manual re-documentation.

Hive receipt cost per MCP call

<$0.001

Cost of one Hive receipt per MCP call. Settlement on Base 8453 in USDC. At enterprise scale, receipt cost is negligible relative to breach exposure.

Pricing

Hive · PQ-Identity Receipt Rail · Netskope

$499 / mo

Pilot

100 receipts/day
For a single Netskope tenant evaluating the receipt rail
Per-MCP-call dual-signed receipts (Ed25519 + ML-DSA-65)
did:hive:agent DID provisioning
separately selected and specified chain anchoring

Start checkout Contact sales

NIST FIPS 204 ML-DSA-65 ML-KEM 768 compatible No lock-in off-chain signed and offline verifiable; chain anchoring requires separate selection and specification

Treasury · Base 8453

0x15184Bf50B3d3F52b60434f8942b7D52F2eB436E

View on BaseScan