Sigstore Python Packages

sigstore-models

Pydantic-based, protobuf-free data models for Sigstore

model-signing

Supply chain security for ML

attestplane

Verifiable audit substrate for AI agents — EU AI Act Article 12 ready. Apache 2.0.

proofbundle

Receipts for AI eval results: turn a result into one signed, offline-verifiable JSON file. Proves who signed it and that nothing changed — not that it's true. Ed25519 + RFC 6962.

keel-verifier

Independent verifier for signed AI audit exports and Permit-spec evidence

trustcheck

Verify PyPI package attestations and improve Python supply-chain security

watermarking-authenticity-mcp

EU AI Act Art.50 watermarking + C2PA 2.1. 2 Dec 2026 deadline. Part of the CSOAI Layer-0: 8 protocols · 100/100 A+++++ · world-leading.

provedex

Cryptographic evidence layer for AI agents. Ed25519-signed, SHA-256-chained audit logs anyone can verify offline.

veritensor

The Anti-Virus for AI Artifacts & RAG Firewall. A static analysis tool scanning Models and Notebooks for RCE, Datasets and RAG docs for Data Poisoning, PII, and Prompt Injections. Secure your AI Supply Chain.

cuttledb

Embedded realtime database with vector search (HNSW), BM25, RRF hybrid retrieval, Boolean DSL, real-time SUB/UNSUB push, and ACID transactions with WAL. One self-contained binary under 1 MB. Apache-2.0.

arkforge-mcp

Third-party cryptographic proof for AI agent API calls — ArkForge Trust Layer MCP server

securescan

Diff-aware security scanning with multi-tool orchestration, deterministic SARIF, and PR-comment rendering.

mcpkernel

The Security Kernel for AI Agents — MCP/A2A gateway with policy enforcement, taint tracking, sandboxed execution, deterministic envelopes, and Sigstore audit. OWASP ASI 2026 compliant.

squash-ai

Squash violations, not velocity. Automated EU AI Act compliance for ML teams — CI/CD-native, open-core, developer-first.

h4-hello

A simple hello world example

whiteprints

A Copier-based cookiecutter for creating Python projects managed by uv.

ainfera-verify

Offline verifier for Ainfera AuditChains. Trust no one — verify the chain yourself.

provedex-pipecat

Pipecat FrameProcessor that signs every frame via the Provedex sidecar.

secretgenerator-py

Auditable random credential generator for AI agents and machine-readable pipelines (Python wrapper around the secretgenerator CLI).

provedex-langchain

LangChain BaseCallbackHandler that signs every LLM and tool callback via the Provedex sidecar. Covers LangGraph by inheritance.

mareforma-agent

Defensive name reservation — install 'mareforma' instead.

mareforma-py

Defensive name reservation — install 'mareforma' instead.

maraforma

Defensive name reservation — install 'mareforma' instead.

pwned-deps

Drop your lockfile in, find out if you're pwned. Compromised-package scanner backed by OSV.dev.