Attestation Python Packages

cyclonedx-python-lib

Functionality and DataModels of OWASP CycloneDX for Python

in-toto-attestation

in-toto Attestation Framework

vaara

Open-source evidence layer for AI governance. Gates every AI agent tool call against your policy and writes a hash-chained execution record an auditor verifies offline, without trusting the operator. Root-agnostic, and binds to a TPM 2.0 or SEV-SNP hardware root when present. Your environment, no SaaS, no telemetry. AGPL-3.0.

attestplane

Verifiable audit substrate for AI agents — EU AI Act Article 12 ready. Apache 2.0.

proofbundle

Receipts for AI eval results: turn a result into one signed, offline-verifiable JSON file. Proves who signed it and that nothing changed — not that it's true. Ed25519 + RFC 6962.

nautilus-rkm

Policy-first data broker for AI agents — one call plans, routes, enforces, attests, and audits every data access. Built on Fathom.

treeship-sdk

Portable trust receipts for agent workflows. Signed, chained, verifiable.

aiir

AI Integrity Receipts — generate, verify, and attest cryptographic receipts for commits with declared AI involvement. Release verification with SLSA-compatible VSA. Zero dependencies. Apache 2.0.

agent-security-harness

470 security tests for AI agent systems — MCP, A2A, x402/L402, decision governance, benchmark integrity, skill supply chain. AIUC-1 pre-cert, NIST AI 800-2 aligned, CVE-2026-25253 reproduction. v4.4.2

halo-record

Tamper-evident runtime records for AI agents. Hash-chained, dependency-free, verifiable by anyone.

attestix

Attestix - Attestation Infrastructure for AI Agents. DID-based agent identity, W3C Verifiable Credentials, EU AI Act compliance layer, delegation chains, and reputation scoring. 47 MCP tools across 9 modules.

compliancelint

EU AI Act compliance: scan, attest, document — from your IDE. Scanner catches code-verifiable violations, AI collects evidence for hybrid obligations, Human Gates capture pure attestations. Source-available (BSL 1.1), MCP-native, audit trail included.

mint-attest

mint-attest — Python SDK for universal work attestation. Register, attest, verify, rate, recommend, and discover agents on the MINT Protocol. @attest decorator + LangChain/CrewAI/AutoGen integrations.

keylime

A CNCF Project to Bootstrap & Maintain Trust on the Edge / Cloud and IoT

mima-governance

Python SDK for AI governance — runtime attestation, GRC evidence, EU AI Act, ISO 42001, SOC 2

meok-attestation-verify

Tiny zero-dependency verifier for MEOK AI Labs compliance attestations (DORA, NIS2, CRA, EU AI Act, CSRD, AI-BOM, Gods Eye). Pipe a signed cert on stdin, get VALID/INVALID back. HMAC-SHA256. By MEOK AI Labs.

notarize-ai

Canonical trace format and verifier for agent execution attestation

colony-memory

Agent memory backup & restore over the Colony vault — versioned, integrity-checked, optionally-signed snapshots. Open-source facade over colony-sdk.

dynamicfeed-verify

DF-VERIFY/1 — verifiable grounding for AI that acts. Reference verifiers (Python/JS/C#), a demo agent, and conformance vectors. Spec: https://dynamicfeed.ai/standard

sev-snp-measure

Calculate AMD SEV/SEV-ES/SEV-SNP measurement for confidential computing

provetrail

An open standard for verifiable execution provenance: a portable, third-party-verifiable record of what an agent did, in what order, and under what governance.

alia-sealed

Cryptographic supply chain attestation. Every binary proven from source to artifact.

model-chain

AI Integrity Receipts — generate, verify, and attest cryptographic receipts for commits with declared AI involvement. Release verification with SLSA-compatible VSA. Zero dependencies. Apache 2.0.

model-attestation

AI Integrity Receipts — generate, verify, and attest cryptographic receipts for commits with declared AI involvement. Release verification with SLSA-compatible VSA. Zero dependencies. Apache 2.0.